SlideShare a Scribd company logo

IcingaCamp Stockholm - NSClient++

•
•
Icinga
Icinga

Presentation given at Icinga Camp Stockholm in October 2016

Technology
1 of 119
Download to read offline
COLLECTD BUG FIXES REST CLIENT IMPROVED WEB UI! COUNT FIX! METRICS
Please don’t be angry! Some times I am busy  Get over here and play NOW!
Core
Core Server Client Check Script Misc
Core Server NRPE NSCA Client NRPE NSCA Check System Eventlog Script Python Lua Misc Scheduler
Core Server NRPE NSCA Client NRPE check_remote NSCA notify_remote Check System check_cpu check_memory … Eventlog Check_eventlog Script Python Script Check_??? Lua Script Check_??? Misc Scheduler
Core Modules … Settings ini reg https://…
foo bar key=value this=that more this=thattest=test
[/modules] CheckDisk=enabled NRPEServer=enabled [/settings/default] allowed hosts=127.0.0.1,icinga.org [/log] level=debug
NRPE Server Core Check System Check EventLog Check ExternalScripts check_foo.bat QUERY NRPE (1024) QUERY Port: 5666 allowed hosts arguments arguments
Level Source … … Error Word … … Error Excel … … Info Word … … Warning Excel … … Error App1 … … Warning App1 … … Error App3 … …
Level Source … … Error Word … … Error Excel … … Info Word … … Warning Excel … … Error App1 … … Warning App1 … … Error App3 … … filter=”level=’error’”
Level Source … … Error Word … … Error Excel … … Info Word … … Warning Excel … … Error App1 … … Warning App1 … … Error App3 … … filter=”source=’App1’”
Level Source … … Error Word … … Error Excel … … Info Word … … Warning Excel … … Error App1 … … Warning App1 … … Error App3 … … filter=”source=’App1’ or source=’App3’”
Level Source … … Error Word … … Error Excel … … Info Word … … Warning Excel … … Error App1 … … Warning App1 … … Error App3 … … filter=”source=’App1’ or source=’App3’ or level=’error’”
Level Source … … Error Word … … Error Excel … … Info Word … … Warning Excel … … Error App1 … … Warning App1 … … Error App3 … … filter=”source=’App1’ or source=’App3’ or level=’error’ or level=’warning’”
Level Source … … Error Word … … Error Excel … … Info Word … … Warning Excel … … Error App1 … … Warning App1 … … Error App3 … … filter=”(source=’App1’ or source=’App3’ or level=’error’ or level=’warning’) and source!=’Excel’”
filter=”(source in (’App1’,’App3’) or level in (’error’,’warning’)) and source != ’Excel’” Level Source … … Error Word … … Error Excel … … Info Word … … Warning Excel … … Error App1 … … Warning App1 … … Error App3 … …
• filter = (id NOT IN ('3', '4', '6', '11', '16', '23', '24', '27', '29', '36', '46', '47', '50', '56', '134', '142', '219', '267', '270', '1006', '1009', '1014', '1030', '1035', '1036', '1055', '1058', '1071', '1073', '1085', '1102', '1110', '1111', '1112', '1131', '1291', '1500', '3095', '5719', '5722', '5783', '5788', '5789', '6008', '7000', '7001', '7003', '7005', '7009', '7011', '7022', '7023', '7024', '7026', '7030', '7031', '7034', '7038', '7041', '9015', '9018', '9026', '9028', '10009', '10010', '10016', '10149', '12294', '15300', '15301', '24679', '36887', '36888', '40960', '40961', '45056') AND level IN ('error', 'warning')) OR (id IN ('3') AND source NOT IN ('FilterManager') AND level IN ('error', 'warning')) OR (id IN ('4') AND source NOT IN ('q57','L2ND') AND level IN ('error', 'warning')) OR (id IN ('6') AND source NOT IN ('Security-Kerberos') AND level IN ('error', 'warning')) OR (id IN ('11') AND source NOT IN ('Kerberos-Key- Distribution-Center') AND level IN ('error', 'warning')) OR (id IN ('16') AND source NOT IN ('WindowsUpdateClient') AND level IN ('error', 'warning')) OR (id IN ('23') AND source NOT IN ('Eventlog') AND level IN ('error', 'warning')) OR (id IN ('24') AND source NOT IN ('Time-Service') AND level IN ('error', 'warning')) OR (id IN ('27') AND source NOT IN ('Eventlog') AND level IN ('error', 'warning')) OR (id IN ('29') AND source NOT IN ('Kerberos-Key-Distribution-Center') AND level IN ('error', 'warning')) OR (id IN ('36') AND source NOT IN ('Time-Service') AND level IN ('error', 'warning')) OR (id IN ('46') AND source NOT IN ('Time-Service') AND level IN ('error', 'warning')) OR (id IN ('47') AND source NOT IN ('Time-Service') AND level IN ('error', 'warning')) OR (id IN ('50') AND source NOT IN ('TermDD','Time-Service') AND level IN ('error', 'warning')) OR (id IN ('56') AND source NOT IN ('TermDD') AND level IN ('error', 'warning')) OR (id IN ('134') AND source NOT IN ('Time-Service') AND level IN ('error', 'warning')) OR (id IN ('142') AND source NOT IN ('Time-Service') AND level IN ('error', 'warning')) OR (id IN ('219') AND source NOT IN ('Kernel-pnp') AND level IN ('error', 'warning')) OR (id IN ('267') AND source NOT IN ('Storage-agents') AND level IN ('error', 'warning')) OR (id IN ('270') AND source NOT IN ('Storage-agents') AND level IN ('error', 'warning')) OR (id IN ('1006') AND source NOT IN ('DNS Client Events','GroupPolicy') AND level IN ('error', 'warning')) OR (id IN ('1009') AND source NOT IN ('picadm') AND level IN ('error', 'warning')) OR (id IN ('1014') AND source NOT IN ('DNS Client Events') AND level IN ('error', 'warning')) OR (id IN ('1030') AND source NOT IN ('GroupPolicy') AND level IN ('error', 'warning')) OR (id IN ('1035') AND source NOT IN ('TerminalServices-RemoteConnectionManager') AND level IN ('error', 'warning')) OR (id IN ('1036') AND source NOT IN ('TerminalServices- RemoteConnectionManager') AND level IN ('error', 'warning')) OR (id IN ('1055') AND source NOT IN ('GroupPolicy') AND level IN ('error', 'warning')) OR (id IN ('1058') AND source NOT IN ('GroupPolicy') AND level IN ('error', 'warning')) OR (id IN ('1071') AND source NOT IN ('TerminalServices-RemoteConnectionManager') AND level IN ('error', 'warning')) OR (id IN ('1073') AND source NOT IN ('USER32') AND level IN ('error', 'warning')) OR (id IN ('1085') AND source NOT IN ('GroupPolicy') AND level IN ('error', 'warning')) OR (id IN ('1102') AND source NOT IN ('SNMP') AND level IN ('error', 'warning')) OR (id IN ('1110') AND source NOT IN ('GroupPolicy') AND level IN ('error', 'warning')) OR (id IN ('1111') AND source NOT IN ('Server Agents') AND level IN ('error', 'warning')) OR (id IN ('1112') AND source NOT IN ('GroupPolicy') AND level IN ('error', 'warning')) OR (id IN ('1131') AND source NOT IN ('TerminalServices- RemoteConnectionManager') AND level IN ('error', 'warning')) OR (id IN ('1291') AND source NOT IN ('NIC-agents') AND level IN ('error', 'warning')) OR (id IN ('1500') AND source NOT IN ('SNMP') AND level IN ('error', 'warning')) OR (id IN ('3095') AND source NOT IN ('Netlogon') AND level IN ('error', 'warning')) OR (id IN ('5719') AND source NOT IN ('Netlogon') AND level IN ('error', 'warning')) OR (id IN ('5722') AND source NOT IN ('Netlogon') AND level IN ('error', 'warning')) OR (id IN ('5783') AND source NOT IN ('Netlogon') AND level IN ('error', 'warning')) OR (id IN ('5788') AND source NOT IN ('Netlogon') AND level IN ('error', 'warning')) OR (id IN ('5789') AND source NOT IN ('Netlogon') AND level IN ('error', 'warning')) OR (id IN ('6008') AND source NOT IN ('Eventlog') AND level IN ('error', 'warning')) OR (id IN ('7000') AND source NOT IN ('service control manager') AND level IN ('error', 'warning')) OR (id IN ('7001') AND source NOT IN ('service control manager') AND level IN ('error', 'warning')) OR (id IN ('7003') AND source NOT IN ('service control manager') AND level IN ('error', 'warning')) OR (id IN ('7005') AND source NOT IN ('service control manager') AND level IN ('error', 'warning')) OR (id IN ('7009') AND source NOT IN ('service control manager') AND level IN ('error', 'warning')) OR (id IN ('7011') AND source NOT IN ('service control manager') AND level IN ('error', 'warning')) OR (id IN ('7022') AND source NOT IN ('service control manager') AND level IN ('error', 'warning')) OR (id IN ('7023') AND source NOT IN ( ('service control manager') AND level IN ('error', 'warning')) OR (id IN ('7024') AND source NOT IN ('service control manager') AND level IN ('error', 'warning')) OR (id IN ('7026') AND source NOT IN ('service control manager') AND level IN ('error', 'warning')) OR (id IN ('7030') AND source NOT IN ('service control manager') AND level IN ('error', 'warning')) OR (id IN ('7031') AND source NOT IN ('service control manager') AND strings not like 'citrix' AND level IN ('error', 'warning')) OR (id IN ('7034') AND source NOT IN ('service control manager') AND level IN ('error', 'warning')) OR (id IN ('7038') AND source NOT IN ('service control manager') AND level IN ('error', 'warning')) OR (id IN ('7041') AND source NOT IN ('service control manager') AND level IN ('error', 'warning')) OR (id IN ('9015') AND source NOT IN ('Metaframe') AND level IN ('error', 'warning')) OR (id IN ('9018') AND source NOT IN ('Metaframe') AND level IN ('error', 'warning')) OR (id IN ('9026') AND source NOT IN ('Metaframe') AND level IN ('error', 'warning')) OR (id IN ('9028') AND source NOT IN ('Metaframe') AND level IN ('error', 'warning')) OR (id IN ('10009') AND source NOT IN ('DistributedCOM') AND level IN ('error', 'warning')) OR (id IN ('10010') AND source NOT IN ('DistributedCOM') AND level IN ('error', 'warning')) OR (id IN ('10016') AND source NOT IN ('DistributedCOM') AND level IN ('error', 'warning')) OR (id IN ('10149') AND source NOT IN ('WindowsRemoteManagement') AND level IN ('error', 'warning')) OR (id IN ('12294') AND source NOT IN ('Directory-Services-SAM') AND level IN ('error', 'warning')) OR (id IN ('15300') AND source NOT IN ('HTTPEVENT') AND level IN ('error', 'warning')) OR (id IN ('15301') AND source NOT IN ('HTTPEVENT') AND level IN ('error', 'warning')) OR (id IN ('24679') AND source NOT IN ('Cissesrv') AND level IN ('error', 'warning')) OR (id IN ('36887') AND source NOT IN ('Schannel') AND level IN ('error', 'warning')) OR (id IN ('36888') AND source NOT IN ('Schannel') AND level IN ('error', 'warning')) OR (id IN ('40960') AND source NOT IN ('LSASRV') AND level IN ('error', 'warning')) OR (id IN ('40961') AND source NOT IN ('LSASRV') AND level IN ('error', 'warning')) OR (id IN ('45056') AND source NOT IN ('LSASRV') AND level IN ('error', 'warning'))
Numbers, constants etc Key Safe Key Description = eq Equals != ne Not equals > gt Greater than < lt Less than >= ge Greater or equal than <= le Less or equal than in (<LIST OF VALUES>) In a given list not in (<LIST OF VALUES>) Not in a given list
Strings Key Safe Key Description = eq Equals != ne Not equals > gt Greater than < lt Less than >= ge Greater or equal than <= le Less or equal than in (<LIST OF VALUES>) In a given list not in (<LIST OF VALUES>) Not in a given list like Substring matching regexp Regular expression not like Opposite of like not regexp Opposite of regexp
Syntax Key Safe Key Description ${foo} %(foo) Expression ‘this is a string’ str(this is a string) Strings
Filter “good” Warning Critical
Level Source … … Error Word … … Error Excel … … Info Word … … Warning Excel … … Error App1 … … Warning App1 … … Error App3 … … filter=”source = ’App1’“ warn=”level = ’Warning’“
detail-syntax=”s: ${source} “ top-syntax=“Hello: ${list}” Hello: s: App1, s: App1, s: App3
NSClient++ https://nsclient.org Michael Medin michael@medin.name https://medin.name @mickem https://www.linkedin.com/in/mickem Slides: http://www.slideshare.net/MichaelMedin

Recommended

NSClient++ whats new for 0.3.9 users
NSClient++ whats new for 0.3.9 usersNSClient++ whats new for 0.3.9 users
NSClient++ whats new for 0.3.9 users
Michael Medin
 
OSMC 2013 | Making monitoring simple? by Michael Medin
OSMC 2013 | Making monitoring simple? by Michael MedinOSMC 2013 | Making monitoring simple? by Michael Medin
OSMC 2013 | Making monitoring simple? by Michael Medin
NETWAYS
 
Nagios Conference 2013 - Michael Medin - NSClient++ Whats New
Nagios Conference 2013 - Michael Medin - NSClient++ Whats NewNagios Conference 2013 - Michael Medin - NSClient++ Whats New
Nagios Conference 2013 - Michael Medin - NSClient++ Whats New
Nagios
 
NSClient++: Monitoring Simplified at OSMC 2013
NSClient++: Monitoring Simplified at OSMC 2013NSClient++: Monitoring Simplified at OSMC 2013
NSClient++: Monitoring Simplified at OSMC 2013
Michael Medin
 
Python 炒股指南
Python 炒股指南 Python 炒股指南
Python 炒股指南
Leo Zhou
 
Cha
ChaCha
Cha
Cielo Rose
 
Deploying Next Gen Systems with Zero Downtime
Deploying Next Gen Systems with Zero DowntimeDeploying Next Gen Systems with Zero Downtime
Deploying Next Gen Systems with Zero Downtime
Twilio Inc
 
There's Waldo by Patrick Wardle & Colby Moore
There's Waldo by Patrick Wardle & Colby MooreThere's Waldo by Patrick Wardle & Colby Moore
There's Waldo by Patrick Wardle & Colby Moore
Shakacon
 

Recommended

NSClient++ whats new for 0.3.9 users
NSClient++ whats new for 0.3.9 usersNSClient++ whats new for 0.3.9 users
NSClient++ whats new for 0.3.9 users
Michael Medin
 
OSMC 2013 | Making monitoring simple? by Michael Medin
OSMC 2013 | Making monitoring simple? by Michael MedinOSMC 2013 | Making monitoring simple? by Michael Medin
OSMC 2013 | Making monitoring simple? by Michael Medin
NETWAYS
 
Nagios Conference 2013 - Michael Medin - NSClient++ Whats New
Nagios Conference 2013 - Michael Medin - NSClient++ Whats NewNagios Conference 2013 - Michael Medin - NSClient++ Whats New
Nagios Conference 2013 - Michael Medin - NSClient++ Whats New
Nagios
 
NSClient++: Monitoring Simplified at OSMC 2013
NSClient++: Monitoring Simplified at OSMC 2013NSClient++: Monitoring Simplified at OSMC 2013
NSClient++: Monitoring Simplified at OSMC 2013
Michael Medin
 
Python 炒股指南
Python 炒股指南 Python 炒股指南
Python 炒股指南
Leo Zhou
 
Cha
ChaCha
Cha
Cielo Rose
 
Deploying Next Gen Systems with Zero Downtime
Deploying Next Gen Systems with Zero DowntimeDeploying Next Gen Systems with Zero Downtime
Deploying Next Gen Systems with Zero Downtime
Twilio Inc
 
There's Waldo by Patrick Wardle & Colby Moore
There's Waldo by Patrick Wardle & Colby MooreThere's Waldo by Patrick Wardle & Colby Moore
There's Waldo by Patrick Wardle & Colby Moore
Shakacon
 
IcingaCamp Stockholm - Opening
IcingaCamp Stockholm - OpeningIcingaCamp Stockholm - Opening
IcingaCamp Stockholm - Opening
Icinga
 
IcingaCamp Stockholm - Graphing with Graphite und Grafana
IcingaCamp Stockholm - Graphing with Graphite und GrafanaIcingaCamp Stockholm - Graphing with Graphite und Grafana
IcingaCamp Stockholm - Graphing with Graphite und Grafana
Icinga
 
Icinga Camp Amsterdam - Monitoring – When to start
Icinga Camp Amsterdam - Monitoring – When to startIcinga Camp Amsterdam - Monitoring – When to start
Icinga Camp Amsterdam - Monitoring – When to start
Icinga
 
Icinga Camp Amsterdam - Icinga Director
Icinga Camp Amsterdam - Icinga DirectorIcinga Camp Amsterdam - Icinga Director
Icinga Camp Amsterdam - Icinga Director
Icinga
 
Icinga Camp Belgrade - ITAF Introduction
Icinga Camp Belgrade - ITAF IntroductionIcinga Camp Belgrade - ITAF Introduction
Icinga Camp Belgrade - ITAF Introduction
Icinga
 
Icinga 2 - Apify them all at Icinga Camp Amsterdam 2016
Icinga 2 - Apify them all at Icinga Camp Amsterdam 2016Icinga 2 - Apify them all at Icinga Camp Amsterdam 2016
Icinga 2 - Apify them all at Icinga Camp Amsterdam 2016
Icinga
 
IcingaCamp Stockholm - Icinga Web2
IcingaCamp Stockholm - Icinga Web2IcingaCamp Stockholm - Icinga Web2
IcingaCamp Stockholm - Icinga Web2
Icinga
 
IcingaCamp Stockholm - How to make your monitoring shut up
IcingaCamp Stockholm - How to make your monitoring shut upIcingaCamp Stockholm - How to make your monitoring shut up
IcingaCamp Stockholm - How to make your monitoring shut up
Icinga
 
Icinga Camp Amsterdam - Infrastructure as Code
Icinga Camp Amsterdam - Infrastructure as CodeIcinga Camp Amsterdam - Infrastructure as Code
Icinga Camp Amsterdam - Infrastructure as Code
Icinga
 
Icinga Camp Amsterdam - Icinga2 and Ansible
Icinga Camp Amsterdam - Icinga2 and AnsibleIcinga Camp Amsterdam - Icinga2 and Ansible
Icinga Camp Amsterdam - Icinga2 and Ansible
Icinga
 
MoniTutor
MoniTutorMoniTutor
MoniTutor
Icinga
 
Icinga Camp Amsterdam - Icinga2 and Puppet
Icinga Camp Amsterdam - Icinga2 and PuppetIcinga Camp Amsterdam - Icinga2 and Puppet
Icinga Camp Amsterdam - Icinga2 and Puppet
Icinga
 
Icinga Camp Belgrade - ITAF Monitoring best practices & demo
Icinga Camp Belgrade - ITAF Monitoring best practices & demoIcinga Camp Belgrade - ITAF Monitoring best practices & demo
Icinga Camp Belgrade - ITAF Monitoring best practices & demo
Icinga
 
Icinga Camp Belgrade - State of Icinga
Icinga Camp Belgrade - State of IcingaIcinga Camp Belgrade - State of Icinga
Icinga Camp Belgrade - State of Icinga
Icinga
 
Icinga Camp Belgrade - Icinga Web 2
Icinga Camp Belgrade - Icinga Web 2Icinga Camp Belgrade - Icinga Web 2
Icinga Camp Belgrade - Icinga Web 2
Icinga
 
Icinga Camp San Francisco 2017 - Icinga Director - Managing your configuration
Icinga Camp San Francisco 2017 - Icinga Director - Managing your configurationIcinga Camp San Francisco 2017 - Icinga Director - Managing your configuration
Icinga Camp San Francisco 2017 - Icinga Director - Managing your configuration
Icinga
 
Icinga Camp San Diego 2016 - Icinga Director
Icinga Camp San Diego 2016 - Icinga DirectorIcinga Camp San Diego 2016 - Icinga Director
Icinga Camp San Diego 2016 - Icinga Director
Icinga
 
Icinga Camp San Diego: Apify them all
Icinga Camp San Diego: Apify them allIcinga Camp San Diego: Apify them all
Icinga Camp San Diego: Apify them all
Icinga
 
Presentation about Icinga at Kiratech DevOps Day in Verona
Presentation about Icinga at Kiratech DevOps Day in VeronaPresentation about Icinga at Kiratech DevOps Day in Verona
Presentation about Icinga at Kiratech DevOps Day in Verona
Icinga
 
Icinga Camp San Diego 2016 - Opening
Icinga Camp San Diego 2016 - OpeningIcinga Camp San Diego 2016 - Opening
Icinga Camp San Diego 2016 - Opening
Icinga
 
Ns client++ whats new (nwc2013)
Ns client++ whats new (nwc2013)Ns client++ whats new (nwc2013)
Ns client++ whats new (nwc2013)
Michael Medin
 
NSClient++ Workshop: 05 Monitoring
NSClient++ Workshop: 05 MonitoringNSClient++ Workshop: 05 Monitoring
NSClient++ Workshop: 05 Monitoring
Michael Medin
 

More Related Content

Viewers also liked

Icinga Camp San Francisco 2017 - Icinga Director - Managing your configuration
Icinga Camp San Francisco 2017 - Icinga Director - Managing your configurationIcinga Camp San Francisco 2017 - Icinga Director - Managing your configuration
Icinga Camp San Francisco 2017 - Icinga Director - Managing your configuration
Icinga
 

Viewers also liked (20)

IcingaCamp Stockholm - Opening
IcingaCamp Stockholm - OpeningIcingaCamp Stockholm - Opening
IcingaCamp Stockholm - Opening
 
IcingaCamp Stockholm - Graphing with Graphite und Grafana
IcingaCamp Stockholm - Graphing with Graphite und GrafanaIcingaCamp Stockholm - Graphing with Graphite und Grafana
IcingaCamp Stockholm - Graphing with Graphite und Grafana
 
Icinga Camp Amsterdam - Monitoring – When to start
Icinga Camp Amsterdam - Monitoring – When to startIcinga Camp Amsterdam - Monitoring – When to start
Icinga Camp Amsterdam - Monitoring – When to start
 
Icinga Camp Amsterdam - Icinga Director
Icinga Camp Amsterdam - Icinga DirectorIcinga Camp Amsterdam - Icinga Director
Icinga Camp Amsterdam - Icinga Director
 
Icinga Camp Belgrade - ITAF Introduction
Icinga Camp Belgrade - ITAF IntroductionIcinga Camp Belgrade - ITAF Introduction
Icinga Camp Belgrade - ITAF Introduction
 
Icinga 2 - Apify them all at Icinga Camp Amsterdam 2016
Icinga 2 - Apify them all at Icinga Camp Amsterdam 2016Icinga 2 - Apify them all at Icinga Camp Amsterdam 2016
Icinga 2 - Apify them all at Icinga Camp Amsterdam 2016
 
IcingaCamp Stockholm - Icinga Web2
IcingaCamp Stockholm - Icinga Web2IcingaCamp Stockholm - Icinga Web2
IcingaCamp Stockholm - Icinga Web2
 
IcingaCamp Stockholm - How to make your monitoring shut up
IcingaCamp Stockholm - How to make your monitoring shut upIcingaCamp Stockholm - How to make your monitoring shut up
IcingaCamp Stockholm - How to make your monitoring shut up
 
Icinga Camp Amsterdam - Infrastructure as Code
Icinga Camp Amsterdam - Infrastructure as CodeIcinga Camp Amsterdam - Infrastructure as Code
Icinga Camp Amsterdam - Infrastructure as Code
 
Icinga Camp Amsterdam - Icinga2 and Ansible
Icinga Camp Amsterdam - Icinga2 and AnsibleIcinga Camp Amsterdam - Icinga2 and Ansible
Icinga Camp Amsterdam - Icinga2 and Ansible
 
MoniTutor
MoniTutorMoniTutor
MoniTutor
 
Icinga Camp Amsterdam - Icinga2 and Puppet
Icinga Camp Amsterdam - Icinga2 and PuppetIcinga Camp Amsterdam - Icinga2 and Puppet
Icinga Camp Amsterdam - Icinga2 and Puppet
 
Icinga Camp Belgrade - ITAF Monitoring best practices & demo
Icinga Camp Belgrade - ITAF Monitoring best practices & demoIcinga Camp Belgrade - ITAF Monitoring best practices & demo
Icinga Camp Belgrade - ITAF Monitoring best practices & demo
 
Icinga Camp Belgrade - State of Icinga
Icinga Camp Belgrade - State of IcingaIcinga Camp Belgrade - State of Icinga
Icinga Camp Belgrade - State of Icinga
 
Icinga Camp Belgrade - Icinga Web 2
Icinga Camp Belgrade - Icinga Web 2Icinga Camp Belgrade - Icinga Web 2
Icinga Camp Belgrade - Icinga Web 2
 
Icinga Camp San Francisco 2017 - Icinga Director - Managing your configuration
Icinga Camp San Francisco 2017 - Icinga Director - Managing your configurationIcinga Camp San Francisco 2017 - Icinga Director - Managing your configuration
Icinga Camp San Francisco 2017 - Icinga Director - Managing your configuration
 
Icinga Camp San Diego 2016 - Icinga Director
Icinga Camp San Diego 2016 - Icinga DirectorIcinga Camp San Diego 2016 - Icinga Director
Icinga Camp San Diego 2016 - Icinga Director
 
Icinga Camp San Diego: Apify them all
Icinga Camp San Diego: Apify them allIcinga Camp San Diego: Apify them all
Icinga Camp San Diego: Apify them all
 
Presentation about Icinga at Kiratech DevOps Day in Verona
Presentation about Icinga at Kiratech DevOps Day in VeronaPresentation about Icinga at Kiratech DevOps Day in Verona
Presentation about Icinga at Kiratech DevOps Day in Verona
 
Icinga Camp San Diego 2016 - Opening
Icinga Camp San Diego 2016 - OpeningIcinga Camp San Diego 2016 - Opening
Icinga Camp San Diego 2016 - Opening
 

Similar to IcingaCamp Stockholm - NSClient++

Database Implementation Final Document
Database Implementation Final DocumentDatabase Implementation Final Document
Database Implementation Final Document
Conor O'Callaghan
 
OWASP PHPIDS talk slides
OWASP PHPIDS talk slidesOWASP PHPIDS talk slides
OWASP PHPIDS talk slides
guestd34230
 

Similar to IcingaCamp Stockholm - NSClient++ (20)

Ns client++ whats new (nwc2013)
Ns client++ whats new (nwc2013)Ns client++ whats new (nwc2013)
Ns client++ whats new (nwc2013)
 
NSClient++ Workshop: 05 Monitoring
NSClient++ Workshop: 05 MonitoringNSClient++ Workshop: 05 Monitoring
NSClient++ Workshop: 05 Monitoring
 
SSL Failing, Sharing, and Scheduling
SSL Failing, Sharing, and SchedulingSSL Failing, Sharing, and Scheduling
SSL Failing, Sharing, and Scheduling
 
Database Implementation Final Document
Database Implementation Final DocumentDatabase Implementation Final Document
Database Implementation Final Document
 
Hunting for malicious modules in npm - NodeSummit
Hunting for malicious modules in npm - NodeSummitHunting for malicious modules in npm - NodeSummit
Hunting for malicious modules in npm - NodeSummit
 
Implementing Server Side Data Synchronization for Mobile Apps
Implementing Server Side Data Synchronization for Mobile AppsImplementing Server Side Data Synchronization for Mobile Apps
Implementing Server Side Data Synchronization for Mobile Apps
 
Ss7 isup homer
Ss7 isup homerSs7 isup homer
Ss7 isup homer
 
Exact Real Arithmetic for Tcl
Exact Real Arithmetic for TclExact Real Arithmetic for Tcl
Exact Real Arithmetic for Tcl
 
Teaching Your Machine To Find Fraudsters
Teaching Your Machine To Find FraudstersTeaching Your Machine To Find Fraudsters
Teaching Your Machine To Find Fraudsters
 
C C++ tutorial for beginners- tibacademy.in
C C++ tutorial for beginners- tibacademy.inC C++ tutorial for beginners- tibacademy.in
C C++ tutorial for beginners- tibacademy.in
 
APIs and Synthetic Biology
APIs and Synthetic BiologyAPIs and Synthetic Biology
APIs and Synthetic Biology
 
Analyzing Log Data With Apache Spark
Analyzing Log Data With Apache SparkAnalyzing Log Data With Apache Spark
Analyzing Log Data With Apache Spark
 
The Ring programming language version 1.8 book - Part 96 of 202
The Ring programming language version 1.8 book - Part 96 of 202The Ring programming language version 1.8 book - Part 96 of 202
The Ring programming language version 1.8 book - Part 96 of 202
 
Eventsourcing with PHP and MongoDB
Eventsourcing with PHP and MongoDBEventsourcing with PHP and MongoDB
Eventsourcing with PHP and MongoDB
 
10 Rules for Safer Code
10 Rules for Safer Code10 Rules for Safer Code
10 Rules for Safer Code
 
OWASP PHPIDS talk slides
OWASP PHPIDS talk slidesOWASP PHPIDS talk slides
OWASP PHPIDS talk slides
 
Synack at ShmooCon 2015
Synack at ShmooCon 2015Synack at ShmooCon 2015
Synack at ShmooCon 2015
 
Yapc Asia 2008 TMTOWTMS
Yapc Asia 2008 TMTOWTMSYapc Asia 2008 TMTOWTMS
Yapc Asia 2008 TMTOWTMS
 
10 Rules for Safer Code [Odoo Experience 2016]
10 Rules for Safer Code [Odoo Experience 2016]10 Rules for Safer Code [Odoo Experience 2016]
10 Rules for Safer Code [Odoo Experience 2016]
 
Bulletproof
BulletproofBulletproof
Bulletproof
 

More from Icinga

Infrastructure Monitoring for Cloud Native Enterprises - Icinga Camp Milan 2023
Infrastructure Monitoring for Cloud Native Enterprises - Icinga Camp Milan 2023Infrastructure Monitoring for Cloud Native Enterprises - Icinga Camp Milan 2023
Infrastructure Monitoring for Cloud Native Enterprises - Icinga Camp Milan 2023
Icinga
 
Moving from Icinga 1 to Icinga 2 + Director - Icinga Camp Zurich 2019
Moving from Icinga 1 to Icinga 2 + Director - Icinga Camp Zurich 2019Moving from Icinga 1 to Icinga 2 + Director - Icinga Camp Zurich 2019
Moving from Icinga 1 to Icinga 2 + Director - Icinga Camp Zurich 2019
Icinga
 
Integrating Icinga 2 and ntopng - Icinga Camp Milan 2019
Integrating Icinga 2 and ntopng - Icinga Camp Milan 2019Integrating Icinga 2 and ntopng - Icinga Camp Milan 2019
Integrating Icinga 2 and ntopng - Icinga Camp Milan 2019
Icinga
 
DevOps monitoring: Best Practices using OpenShift combined with Icinga & Big ...
DevOps monitoring: Best Practices using OpenShift combined with Icinga & Big ...DevOps monitoring: Best Practices using OpenShift combined with Icinga & Big ...
DevOps monitoring: Best Practices using OpenShift combined with Icinga & Big ...
Icinga
 
Best of Icinga Modules - Icinga Camp Milan 2019
Best of Icinga Modules - Icinga Camp Milan 2019Best of Icinga Modules - Icinga Camp Milan 2019
Best of Icinga Modules - Icinga Camp Milan 2019
Icinga
 

More from Icinga (20)

Upgrading Incident Management with Icinga - Icinga Camp Milan 2023
Upgrading Incident Management with Icinga - Icinga Camp Milan 2023Upgrading Incident Management with Icinga - Icinga Camp Milan 2023
Upgrading Incident Management with Icinga - Icinga Camp Milan 2023
 
Extending Icinga Web with Modules: powerful, smart and easily created - Icing...
Extending Icinga Web with Modules: powerful, smart and easily created - Icing...Extending Icinga Web with Modules: powerful, smart and easily created - Icing...
Extending Icinga Web with Modules: powerful, smart and easily created - Icing...
 
Infrastructure Monitoring for Cloud Native Enterprises - Icinga Camp Milan 2023
Infrastructure Monitoring for Cloud Native Enterprises - Icinga Camp Milan 2023Infrastructure Monitoring for Cloud Native Enterprises - Icinga Camp Milan 2023
Infrastructure Monitoring for Cloud Native Enterprises - Icinga Camp Milan 2023
 
Incident management: Best industry practices your team should know - Icinga C...
Incident management: Best industry practices your team should know - Icinga C...Incident management: Best industry practices your team should know - Icinga C...
Incident management: Best industry practices your team should know - Icinga C...
 
Monitoring Cooling Units in a pharmaceutical GxP regulated environment - Icin...
Monitoring Cooling Units in a pharmaceutical GxP regulated environment - Icin...Monitoring Cooling Units in a pharmaceutical GxP regulated environment - Icin...
Monitoring Cooling Units in a pharmaceutical GxP regulated environment - Icin...
 
SNMP Monitoring at scale - Icinga Camp Milan 2023
SNMP Monitoring at scale - Icinga Camp Milan 2023SNMP Monitoring at scale - Icinga Camp Milan 2023
SNMP Monitoring at scale - Icinga Camp Milan 2023
 
Monitoring Kubernetes with Icinga - Icinga Camp Milan 2023
Monitoring Kubernetes with Icinga - Icinga Camp Milan 2023Monitoring Kubernetes with Icinga - Icinga Camp Milan 2023
Monitoring Kubernetes with Icinga - Icinga Camp Milan 2023
 
Current State of Icinga - Icinga Camp Milan 2023
Current State of Icinga - Icinga Camp Milan 2023Current State of Icinga - Icinga Camp Milan 2023
Current State of Icinga - Icinga Camp Milan 2023
 
Efficient IT operations using monitoring systems and standardized tools - Ici...
Efficient IT operations using monitoring systems and standardized tools - Ici...Efficient IT operations using monitoring systems and standardized tools - Ici...
Efficient IT operations using monitoring systems and standardized tools - Ici...
 
Tornado Complex Event Processing Framework for Icinga - Icinga Camp Zurich 2019
Tornado Complex Event Processing Framework for Icinga - Icinga Camp Zurich 2019Tornado Complex Event Processing Framework for Icinga - Icinga Camp Zurich 2019
Tornado Complex Event Processing Framework for Icinga - Icinga Camp Zurich 2019
 
Signalilo: Visualizing Prometheus alerts in Icinga2 - Icinga Camp Zurich 2019
Signalilo: Visualizing Prometheus alerts in Icinga2 - Icinga Camp Zurich 2019Signalilo: Visualizing Prometheus alerts in Icinga2 - Icinga Camp Zurich 2019
Signalilo: Visualizing Prometheus alerts in Icinga2 - Icinga Camp Zurich 2019
 
Moving from Icinga 1 to Icinga 2 + Director - Icinga Camp Zurich 2019
Moving from Icinga 1 to Icinga 2 + Director - Icinga Camp Zurich 2019Moving from Icinga 1 to Icinga 2 + Director - Icinga Camp Zurich 2019
Moving from Icinga 1 to Icinga 2 + Director - Icinga Camp Zurich 2019
 
Icinga Director and vSphereDB - how they play together - Icinga Camp Zurich 2019
Icinga Director and vSphereDB - how they play together - Icinga Camp Zurich 2019Icinga Director and vSphereDB - how they play together - Icinga Camp Zurich 2019
Icinga Director and vSphereDB - how they play together - Icinga Camp Zurich 2019
 
Current State of Icinga - Icinga Camp Zurich 2019
Current State of Icinga - Icinga Camp Zurich 2019Current State of Icinga - Icinga Camp Zurich 2019
Current State of Icinga - Icinga Camp Zurich 2019
 
NetEye 4 based on Icinga 2 - Icinga Camp Milan 2019
NetEye 4 based on Icinga 2 - Icinga Camp Milan 2019NetEye 4 based on Icinga 2 - Icinga Camp Milan 2019
NetEye 4 based on Icinga 2 - Icinga Camp Milan 2019
 
Integrating Icinga 2 and ntopng - Icinga Camp Milan 2019
Integrating Icinga 2 and ntopng - Icinga Camp Milan 2019Integrating Icinga 2 and ntopng - Icinga Camp Milan 2019
Integrating Icinga 2 and ntopng - Icinga Camp Milan 2019
 
DevOps monitoring: Best Practices using OpenShift combined with Icinga & Big ...
DevOps monitoring: Best Practices using OpenShift combined with Icinga & Big ...DevOps monitoring: Best Practices using OpenShift combined with Icinga & Big ...
DevOps monitoring: Best Practices using OpenShift combined with Icinga & Big ...
 
Current State of Icinga - Icinga Camp Milan 2019
Current State of Icinga - Icinga Camp Milan 2019Current State of Icinga - Icinga Camp Milan 2019
Current State of Icinga - Icinga Camp Milan 2019
 
Best of Icinga Modules - Icinga Camp Milan 2019
Best of Icinga Modules - Icinga Camp Milan 2019Best of Icinga Modules - Icinga Camp Milan 2019
Best of Icinga Modules - Icinga Camp Milan 2019
 
hallenges of Monitoring Big Infrastructure - Icinga Camp Milan 2019
hallenges of Monitoring Big Infrastructure - Icinga Camp Milan 2019hallenges of Monitoring Big Infrastructure - Icinga Camp Milan 2019
hallenges of Monitoring Big Infrastructure - Icinga Camp Milan 2019
 

Recently uploaded

Biography Of Angeliki Cooney | Senior Vice President Life Sciences | Albany, ...
Biography Of Angeliki Cooney | Senior Vice President Life Sciences | Albany, ...Biography Of Angeliki Cooney | Senior Vice President Life Sciences | Albany, ...
Biography Of Angeliki Cooney | Senior Vice President Life Sciences | Albany, ...
Angeliki Cooney
 
Why Teams call analytics are critical to your entire business
Why Teams call analytics are critical to your entire businessWhy Teams call analytics are critical to your entire business
Why Teams call analytics are critical to your entire business
panagenda
 
Strategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff
Strategize a Smooth Tenant-to-tenant Migration and Copilot TakeoffStrategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff
Strategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff
sammart93
 
Modular Monolith - a Practical Alternative to Microservices @ Devoxx UK 2024
Modular Monolith - a Practical Alternative to Microservices @ Devoxx UK 2024Modular Monolith - a Practical Alternative to Microservices @ Devoxx UK 2024
Modular Monolith - a Practical Alternative to Microservices @ Devoxx UK 2024
Victor Rentea
 
Finding Java's Hidden Performance Traps @ DevoxxUK 2024
Finding Java's Hidden Performance Traps @ DevoxxUK 2024Finding Java's Hidden Performance Traps @ DevoxxUK 2024
Finding Java's Hidden Performance Traps @ DevoxxUK 2024
Victor Rentea
 
Web Form Automation for Bonterra Impact Management (fka Social Solutions Apri...
Web Form Automation for Bonterra Impact Management (fka Social Solutions Apri...Web Form Automation for Bonterra Impact Management (fka Social Solutions Apri...
Web Form Automation for Bonterra Impact Management (fka Social Solutions Apri...
Jeffrey Haguewood
 

Recently uploaded (20)

Apidays New York 2024 - The value of a flexible API Management solution for O...
Apidays New York 2024 - The value of a flexible API Management solution for O...Apidays New York 2024 - The value of a flexible API Management solution for O...
Apidays New York 2024 - The value of a flexible API Management solution for O...
 
ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemke
ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemkeProductAnonymous-April2024-WinProductDiscovery-MelissaKlemke
ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemke
 
presentation ICT roal in 21st century education
presentation ICT roal in 21st century educationpresentation ICT roal in 21st century education
presentation ICT roal in 21st century education
 
[BuildWithAI] Introduction to Gemini.pdf
[BuildWithAI] Introduction to Gemini.pdf[BuildWithAI] Introduction to Gemini.pdf
[BuildWithAI] Introduction to Gemini.pdf
 
EMPOWERMENT TECHNOLOGY GRADE 11 QUARTER 2 REVIEWER
EMPOWERMENT TECHNOLOGY GRADE 11 QUARTER 2 REVIEWEREMPOWERMENT TECHNOLOGY GRADE 11 QUARTER 2 REVIEWER
EMPOWERMENT TECHNOLOGY GRADE 11 QUARTER 2 REVIEWER
 
Biography Of Angeliki Cooney | Senior Vice President Life Sciences | Albany, ...
Biography Of Angeliki Cooney | Senior Vice President Life Sciences | Albany, ...Biography Of Angeliki Cooney | Senior Vice President Life Sciences | Albany, ...
Biography Of Angeliki Cooney | Senior Vice President Life Sciences | Albany, ...
 
Why Teams call analytics are critical to your entire business
Why Teams call analytics are critical to your entire businessWhy Teams call analytics are critical to your entire business
Why Teams call analytics are critical to your entire business
 
FWD Group - Insurer Innovation Award 2024
FWD Group - Insurer Innovation Award 2024FWD Group - Insurer Innovation Award 2024
FWD Group - Insurer Innovation Award 2024
 
Strategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff
Strategize a Smooth Tenant-to-tenant Migration and Copilot TakeoffStrategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff
Strategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff
 
Apidays New York 2024 - Accelerating FinTech Innovation by Vasa Krishnan, Fin...
Apidays New York 2024 - Accelerating FinTech Innovation by Vasa Krishnan, Fin...Apidays New York 2024 - Accelerating FinTech Innovation by Vasa Krishnan, Fin...
Apidays New York 2024 - Accelerating FinTech Innovation by Vasa Krishnan, Fin...
 
Boost Fertility New Invention Ups Success Rates.pdf
Boost Fertility New Invention Ups Success Rates.pdfBoost Fertility New Invention Ups Success Rates.pdf
Boost Fertility New Invention Ups Success Rates.pdf
 
Modular Monolith - a Practical Alternative to Microservices @ Devoxx UK 2024
Modular Monolith - a Practical Alternative to Microservices @ Devoxx UK 2024Modular Monolith - a Practical Alternative to Microservices @ Devoxx UK 2024
Modular Monolith - a Practical Alternative to Microservices @ Devoxx UK 2024
 
Apidays New York 2024 - Passkeys: Developing APIs to enable passwordless auth...
Apidays New York 2024 - Passkeys: Developing APIs to enable passwordless auth...Apidays New York 2024 - Passkeys: Developing APIs to enable passwordless auth...
Apidays New York 2024 - Passkeys: Developing APIs to enable passwordless auth...
 
Polkadot JAM Slides - Token2049 - By Dr. Gavin Wood
Polkadot JAM Slides - Token2049 - By Dr. Gavin WoodPolkadot JAM Slides - Token2049 - By Dr. Gavin Wood
Polkadot JAM Slides - Token2049 - By Dr. Gavin Wood
 
DBX First Quarter 2024 Investor Presentation
DBX First Quarter 2024 Investor PresentationDBX First Quarter 2024 Investor Presentation
DBX First Quarter 2024 Investor Presentation
 
AWS Community Day CPH - Three problems of Terraform
AWS Community Day CPH - Three problems of TerraformAWS Community Day CPH - Three problems of Terraform
AWS Community Day CPH - Three problems of Terraform
 
Exploring the Future Potential of AI-Enabled Smartphone Processors
Exploring the Future Potential of AI-Enabled Smartphone ProcessorsExploring the Future Potential of AI-Enabled Smartphone Processors
Exploring the Future Potential of AI-Enabled Smartphone Processors
 
Finding Java's Hidden Performance Traps @ DevoxxUK 2024
Finding Java's Hidden Performance Traps @ DevoxxUK 2024Finding Java's Hidden Performance Traps @ DevoxxUK 2024
Finding Java's Hidden Performance Traps @ DevoxxUK 2024
 
Web Form Automation for Bonterra Impact Management (fka Social Solutions Apri...
Web Form Automation for Bonterra Impact Management (fka Social Solutions Apri...Web Form Automation for Bonterra Impact Management (fka Social Solutions Apri...
Web Form Automation for Bonterra Impact Management (fka Social Solutions Apri...
 
Spring Boot vs Quarkus the ultimate battle - DevoxxUK
Spring Boot vs Quarkus the ultimate battle - DevoxxUKSpring Boot vs Quarkus the ultimate battle - DevoxxUK
Spring Boot vs Quarkus the ultimate battle - DevoxxUK
 

IcingaCamp Stockholm - NSClient++

  • 1.
  • 2.
  • 3.
  • 4.
  • 5.
  • 6.
  • 7.
  • 8.
  • 9.
  • 10.
  • 11.
  • 12.
  • 13.
  • 14.
  • 15.
  • 16.
  • 17.
  • 18.
  • 19.
  • 20.
  • 21.
  • 22.
  • 23.
  • 24.
  • 25.
  • 26. COLLECTD BUG FIXES REST CLIENT IMPROVED WEB UI! COUNT FIX! METRICS
  • 27. Please don’t be angry! Some times I am busy  Get over here and play NOW!
  • 28.
  • 29.
  • 30.
  • 31.
  • 32.
  • 33.
  • 34.
  • 35.
  • 36.
  • 37.
  • 38.
  • 39.
  • 40.
  • 41.
  • 42.
  • 43.
  • 44.
  • 45.
  • 46.
  • 47.
  • 48.
  • 49. Core
  • 52. Core Server NRPE NSCA Client NRPE check_remote NSCA notify_remote Check System check_cpu check_memory … Eventlog Check_eventlog Script Python Script Check_??? Lua Script Check_??? Misc Scheduler
  • 54.
  • 55.
  • 56.
  • 59.
  • 60.
  • 61.
  • 63.
  • 64.
  • 65.
  • 66.
  • 67.
  • 68.
  • 69.
  • 70.
  • 71.
  • 72.
  • 73.
  • 74.
  • 75.
  • 76.
  • 77.
  • 78.
  • 79.
  • 80. Level Source … … Error Word … … Error Excel … … Info Word … … Warning Excel … … Error App1 … … Warning App1 … … Error App3 … …
  • 81. Level Source … … Error Word … … Error Excel … … Info Word … … Warning Excel … … Error App1 … … Warning App1 … … Error App3 … … filter=”level=’error’”
  • 82. Level Source … … Error Word … … Error Excel … … Info Word … … Warning Excel … … Error App1 … … Warning App1 … … Error App3 … … filter=”source=’App1’”
  • 83. Level Source … … Error Word … … Error Excel … … Info Word … … Warning Excel … … Error App1 … … Warning App1 … … Error App3 … … filter=”source=’App1’ or source=’App3’”
  • 84. Level Source … … Error Word … … Error Excel … … Info Word … … Warning Excel … … Error App1 … … Warning App1 … … Error App3 … … filter=”source=’App1’ or source=’App3’ or level=’error’”
  • 85. Level Source … … Error Word … … Error Excel … … Info Word … … Warning Excel … … Error App1 … … Warning App1 … … Error App3 … … filter=”source=’App1’ or source=’App3’ or level=’error’ or level=’warning’”
  • 86. Level Source … … Error Word … … Error Excel … … Info Word … … Warning Excel … … Error App1 … … Warning App1 … … Error App3 … … filter=”(source=’App1’ or source=’App3’ or level=’error’ or level=’warning’) and source!=’Excel’”
  • 87. filter=”(source in (’App1’,’App3’) or level in (’error’,’warning’)) and source != ’Excel’” Level Source … … Error Word … … Error Excel … … Info Word … … Warning Excel … … Error App1 … … Warning App1 … … Error App3 … …
  • 88. • filter = (id NOT IN ('3', '4', '6', '11', '16', '23', '24', '27', '29', '36', '46', '47', '50', '56', '134', '142', '219', '267', '270', '1006', '1009', '1014', '1030', '1035', '1036', '1055', '1058', '1071', '1073', '1085', '1102', '1110', '1111', '1112', '1131', '1291', '1500', '3095', '5719', '5722', '5783', '5788', '5789', '6008', '7000', '7001', '7003', '7005', '7009', '7011', '7022', '7023', '7024', '7026', '7030', '7031', '7034', '7038', '7041', '9015', '9018', '9026', '9028', '10009', '10010', '10016', '10149', '12294', '15300', '15301', '24679', '36887', '36888', '40960', '40961', '45056') AND level IN ('error', 'warning')) OR (id IN ('3') AND source NOT IN ('FilterManager') AND level IN ('error', 'warning')) OR (id IN ('4') AND source NOT IN ('q57','L2ND') AND level IN ('error', 'warning')) OR (id IN ('6') AND source NOT IN ('Security-Kerberos') AND level IN ('error', 'warning')) OR (id IN ('11') AND source NOT IN ('Kerberos-Key- Distribution-Center') AND level IN ('error', 'warning')) OR (id IN ('16') AND source NOT IN ('WindowsUpdateClient') AND level IN ('error', 'warning')) OR (id IN ('23') AND source NOT IN ('Eventlog') AND level IN ('error', 'warning')) OR (id IN ('24') AND source NOT IN ('Time-Service') AND level IN ('error', 'warning')) OR (id IN ('27') AND source NOT IN ('Eventlog') AND level IN ('error', 'warning')) OR (id IN ('29') AND source NOT IN ('Kerberos-Key-Distribution-Center') AND level IN ('error', 'warning')) OR (id IN ('36') AND source NOT IN ('Time-Service') AND level IN ('error', 'warning')) OR (id IN ('46') AND source NOT IN ('Time-Service') AND level IN ('error', 'warning')) OR (id IN ('47') AND source NOT IN ('Time-Service') AND level IN ('error', 'warning')) OR (id IN ('50') AND source NOT IN ('TermDD','Time-Service') AND level IN ('error', 'warning')) OR (id IN ('56') AND source NOT IN ('TermDD') AND level IN ('error', 'warning')) OR (id IN ('134') AND source NOT IN ('Time-Service') AND level IN ('error', 'warning')) OR (id IN ('142') AND source NOT IN ('Time-Service') AND level IN ('error', 'warning')) OR (id IN ('219') AND source NOT IN ('Kernel-pnp') AND level IN ('error', 'warning')) OR (id IN ('267') AND source NOT IN ('Storage-agents') AND level IN ('error', 'warning')) OR (id IN ('270') AND source NOT IN ('Storage-agents') AND level IN ('error', 'warning')) OR (id IN ('1006') AND source NOT IN ('DNS Client Events','GroupPolicy') AND level IN ('error', 'warning')) OR (id IN ('1009') AND source NOT IN ('picadm') AND level IN ('error', 'warning')) OR (id IN ('1014') AND source NOT IN ('DNS Client Events') AND level IN ('error', 'warning')) OR (id IN ('1030') AND source NOT IN ('GroupPolicy') AND level IN ('error', 'warning')) OR (id IN ('1035') AND source NOT IN ('TerminalServices-RemoteConnectionManager') AND level IN ('error', 'warning')) OR (id IN ('1036') AND source NOT IN ('TerminalServices- RemoteConnectionManager') AND level IN ('error', 'warning')) OR (id IN ('1055') AND source NOT IN ('GroupPolicy') AND level IN ('error', 'warning')) OR (id IN ('1058') AND source NOT IN ('GroupPolicy') AND level IN ('error', 'warning')) OR (id IN ('1071') AND source NOT IN ('TerminalServices-RemoteConnectionManager') AND level IN ('error', 'warning')) OR (id IN ('1073') AND source NOT IN ('USER32') AND level IN ('error', 'warning')) OR (id IN ('1085') AND source NOT IN ('GroupPolicy') AND level IN ('error', 'warning')) OR (id IN ('1102') AND source NOT IN ('SNMP') AND level IN ('error', 'warning')) OR (id IN ('1110') AND source NOT IN ('GroupPolicy') AND level IN ('error', 'warning')) OR (id IN ('1111') AND source NOT IN ('Server Agents') AND level IN ('error', 'warning')) OR (id IN ('1112') AND source NOT IN ('GroupPolicy') AND level IN ('error', 'warning')) OR (id IN ('1131') AND source NOT IN ('TerminalServices- RemoteConnectionManager') AND level IN ('error', 'warning')) OR (id IN ('1291') AND source NOT IN ('NIC-agents') AND level IN ('error', 'warning')) OR (id IN ('1500') AND source NOT IN ('SNMP') AND level IN ('error', 'warning')) OR (id IN ('3095') AND source NOT IN ('Netlogon') AND level IN ('error', 'warning')) OR (id IN ('5719') AND source NOT IN ('Netlogon') AND level IN ('error', 'warning')) OR (id IN ('5722') AND source NOT IN ('Netlogon') AND level IN ('error', 'warning')) OR (id IN ('5783') AND source NOT IN ('Netlogon') AND level IN ('error', 'warning')) OR (id IN ('5788') AND source NOT IN ('Netlogon') AND level IN ('error', 'warning')) OR (id IN ('5789') AND source NOT IN ('Netlogon') AND level IN ('error', 'warning')) OR (id IN ('6008') AND source NOT IN ('Eventlog') AND level IN ('error', 'warning')) OR (id IN ('7000') AND source NOT IN ('service control manager') AND level IN ('error', 'warning')) OR (id IN ('7001') AND source NOT IN ('service control manager') AND level IN ('error', 'warning')) OR (id IN ('7003') AND source NOT IN ('service control manager') AND level IN ('error', 'warning')) OR (id IN ('7005') AND source NOT IN ('service control manager') AND level IN ('error', 'warning')) OR (id IN ('7009') AND source NOT IN ('service control manager') AND level IN ('error', 'warning')) OR (id IN ('7011') AND source NOT IN ('service control manager') AND level IN ('error', 'warning')) OR (id IN ('7022') AND source NOT IN ('service control manager') AND level IN ('error', 'warning')) OR (id IN ('7023') AND source NOT IN ( ('service control manager') AND level IN ('error', 'warning')) OR (id IN ('7024') AND source NOT IN ('service control manager') AND level IN ('error', 'warning')) OR (id IN ('7026') AND source NOT IN ('service control manager') AND level IN ('error', 'warning')) OR (id IN ('7030') AND source NOT IN ('service control manager') AND level IN ('error', 'warning')) OR (id IN ('7031') AND source NOT IN ('service control manager') AND strings not like 'citrix' AND level IN ('error', 'warning')) OR (id IN ('7034') AND source NOT IN ('service control manager') AND level IN ('error', 'warning')) OR (id IN ('7038') AND source NOT IN ('service control manager') AND level IN ('error', 'warning')) OR (id IN ('7041') AND source NOT IN ('service control manager') AND level IN ('error', 'warning')) OR (id IN ('9015') AND source NOT IN ('Metaframe') AND level IN ('error', 'warning')) OR (id IN ('9018') AND source NOT IN ('Metaframe') AND level IN ('error', 'warning')) OR (id IN ('9026') AND source NOT IN ('Metaframe') AND level IN ('error', 'warning')) OR (id IN ('9028') AND source NOT IN ('Metaframe') AND level IN ('error', 'warning')) OR (id IN ('10009') AND source NOT IN ('DistributedCOM') AND level IN ('error', 'warning')) OR (id IN ('10010') AND source NOT IN ('DistributedCOM') AND level IN ('error', 'warning')) OR (id IN ('10016') AND source NOT IN ('DistributedCOM') AND level IN ('error', 'warning')) OR (id IN ('10149') AND source NOT IN ('WindowsRemoteManagement') AND level IN ('error', 'warning')) OR (id IN ('12294') AND source NOT IN ('Directory-Services-SAM') AND level IN ('error', 'warning')) OR (id IN ('15300') AND source NOT IN ('HTTPEVENT') AND level IN ('error', 'warning')) OR (id IN ('15301') AND source NOT IN ('HTTPEVENT') AND level IN ('error', 'warning')) OR (id IN ('24679') AND source NOT IN ('Cissesrv') AND level IN ('error', 'warning')) OR (id IN ('36887') AND source NOT IN ('Schannel') AND level IN ('error', 'warning')) OR (id IN ('36888') AND source NOT IN ('Schannel') AND level IN ('error', 'warning')) OR (id IN ('40960') AND source NOT IN ('LSASRV') AND level IN ('error', 'warning')) OR (id IN ('40961') AND source NOT IN ('LSASRV') AND level IN ('error', 'warning')) OR (id IN ('45056') AND source NOT IN ('LSASRV') AND level IN ('error', 'warning'))
  • 89. Numbers, constants etc Key Safe Key Description = eq Equals != ne Not equals > gt Greater than < lt Less than >= ge Greater or equal than <= le Less or equal than in (<LIST OF VALUES>) In a given list not in (<LIST OF VALUES>) Not in a given list
  • 90. Strings Key Safe Key Description = eq Equals != ne Not equals > gt Greater than < lt Less than >= ge Greater or equal than <= le Less or equal than in (<LIST OF VALUES>) In a given list not in (<LIST OF VALUES>) Not in a given list like Substring matching regexp Regular expression not like Opposite of like not regexp Opposite of regexp
  • 91. Syntax Key Safe Key Description ${foo} %(foo) Expression ‘this is a string’ str(this is a string) Strings
  • 92.
  • 94. Level Source … … Error Word … … Error Excel … … Info Word … … Warning Excel … … Error App1 … … Warning App1 … … Error App3 … … filter=”source = ’App1’“ warn=”level = ’Warning’“
  • 95. detail-syntax=”s: ${source} “ top-syntax=“Hello: ${list}” Hello: s: App1, s: App1, s: App3
  • 96.
  • 97.
  • 98.
  • 99.
  • 100.
  • 101.
  • 102.
  • 103.
  • 104.
  • 105.
  • 106.
  • 107.
  • 108.
  • 109.
  • 110.
  • 111.
  • 112.
  • 113.
  • 114.
  • 115.
  • 116.
  • 117.
  • 118.