NSClient++ Workshop: 05 Monitoring
•
0 likes•798 views
The document discusses various ways of filtering and setting boundaries for monitoring checks in NSClient++. It provides examples of using warn and crit expressions to define boundaries for check_cpu and explores filters that can be used with checks like check_pagefile and check_cpu. It also shows how to recreate the default parameters for check_eventlog and provides examples of running checks against remote computers.
Recommended
Recommended
More Related Content
Similar to NSClient++ Workshop: 05 Monitoring
Similar to NSClient++ Workshop: 05 Monitoring (20)
More from Michael Medin
More from Michael Medin (20)
Recently uploaded
Recently uploaded (20)
NSClient++ Workshop: 05 Monitoring
- 7. mostly
- 9. Level Source … … Error Word … … Error Excel … … Info Word … … Warning Excel … … Error App1 … … Warning App1 … … Error App3 … …
- 10. Level Source … … Error Word … … Error Excel … … Info Word … … Warning Excel … … Error App1 … … Warning App1 … … Error App3 … … filter=”level=’error’”
- 11. Level Source … … Error Word … … Error Excel … … Info Word … … Warning Excel … … Error App1 … … Warning App1 … … Error App3 … … filter=”source=’App1’”
- 12. Level Source … … Error Word … … Error Excel … … Info Word … … Warning Excel … … Error App1 … … Warning App1 … … Error App3 … … filter=”source=’App1‘”
- 13. Level Source … … Error Word … … Error Excel … … Info Word … … Warning Excel … … Error App1 … … Warning App1 … … Error App3 … … filter=”source=’App1’ or source=’App3’”
- 14. Level Source … … Error Word … … Error Excel … … Info Word … … Warning Excel … … Error App1 … … Warning App1 … … Error App3 … … filter=”source=’App1’ or source=’App3’ or level=’error’”
- 15. Level Source … … Error Word … … Error Excel … … Info Word … … Warning Excel … … Error App1 … … Warning App1 … … Error App3 … … filter=”source=’App1’ or source=’App3’ or level=’error’ or level=’warning’”
- 16. Level Source … … Error Word … … Error Excel … … Info Word … … Warning Excel … … Error App1 … … Warning App1 … … Error App3 … … filter=”(source=’App1’ or source=’App3’ or level=’error’ or level=’warning’)and source!=’Excel’”
- 17. Level Source … … Error Word … … Error Excel … … Info Word … … Warning Excel … … Error App1 … … Warning App1 … … Error App3 … … filter=”(source = ’App1’ or source = ’App3’or level = ’error’ or level = ’warning’) and source != ’Excel’” filter=”(source in (’App1’,’App3’)or level in (’error’,’warning’)) and source != ’Excel’”
- 18. filter = (id NOT IN ('3', '4', '6', '11', '16', '23', '24', '27', '29', '36', '46', '47', '50', '56', '134', '142', '219', '267', '270', '1006', '1009', '1014', '1030', '1035', '1036', '1055', '1058', '1071', '1073', '1085', '1102', '1110', '1111', '1112', '1131', '1291', '1500', '3095', '5719', '5722', '5783', '5788', '5789', '6008', '7000', '7001', '7003', '7005', '7009', '7011', '7022', '7023', '7024', '7026', '7030', '7031', '7034', '7038', '7041', '9015', '9018', '9026', '9028', '10009', '10010', '10016', '10149', '12294', '15300', '15301', '24679', '36887', '36888', '40960', '40961', '45056') AND level IN ('error', 'warning')) OR (id IN ('3') AND source NOT IN ('FilterManager') AND level IN ('error', 'warning')) OR (id IN ('4') AND source NOT IN ('q57','L2ND') AND level IN ('error', 'warning')) OR (id IN ('6') AND source NOT IN ('Security-Kerberos') AND level IN ('error', 'warning')) OR (id IN ('11') AND source NOT IN ('Kerberos-Key- Distribution-Center') AND level IN ('error', 'warning')) OR (id IN ('16') AND source NOT IN ('WindowsUpdateClient') AND level IN ('error', 'warning')) OR (id IN ('23') AND source NOT IN ('Eventlog') AND level IN ('error', 'warning')) OR (id IN ('24') AND source NOT IN ('Time-Service') AND level IN ('error', 'warning')) OR (id IN ('27') AND source NOT IN ('Eventlog') AND level IN ('error', 'warning')) OR (id IN ('29') AND source NOT IN ('Kerberos-Key-Distribution-Center') AND level IN ('error', 'warning')) OR (id IN ('36') AND source NOT IN ('Time-Service') AND level IN ('error', 'warning')) OR (id IN ('46') AND source NOT IN ('Time-Service') AND level IN ('error', 'warning')) OR (id IN ('47') AND source NOT IN ('Time-Service') AND level IN ('error', 'warning')) OR (id IN ('50') AND source NOT IN ('TermDD','Time-Service') AND level IN ('error', 'warning')) OR (id IN ('56') AND source NOT IN ('TermDD') AND level IN ('error', 'warning')) OR (id IN ('134') AND source NOT IN ('Time-Service') AND level IN ('error', 'warning')) OR (id IN ('142') AND source NOT IN ('Time-Service') AND level IN ('error', 'warning')) OR (id IN ('219') AND source NOT IN ('Kernel-pnp') AND level IN ('error', 'warning')) OR (id IN ('267') AND source NOT IN ('Storage-agents') AND level IN ('error', 'warning')) OR (id IN ('270') AND source NOT IN ('Storage-agents') AND level IN ('error', 'warning')) OR (id IN ('1006') AND source NOT IN ('DNS Client Events','GroupPolicy') AND level IN ('error', 'warning')) OR (id IN ('1009') AND source NOT IN ('picadm') AND level IN ('error', 'warning')) OR (id IN ('1014') AND source NOT IN ('DNS Client Events') AND level IN ('error', 'warning')) OR (id IN ('1030') AND source NOT IN ('GroupPolicy') AND level IN ('error', 'warning')) OR
- 19. Key Safe Key Description = eq Equals != ne Notequals > gt Greater than < lt Less than >= ge Greater or equal than <= le Less or equal than in ( <LISTOF VALUES>) In a given list not in (…) Not in a given list
- 20. Key Safe Key Description = eq Equals != ne Notequals > gt Greater than < lt Less than >= ge Greater or equal than <= le Less or equal than in ( <LISTOF VALUES>) In a given list not in (…) Not in a given list like Substring matching regexp Regular expression not like Opposite of like not regexp Oppositeof regexp
- 23. Level Source … … Error Word … … Error Excel … … Info Word … … Warning Excel … … Error App1 … … Warning App1 … … Error App3 … … filter=” source = ’App1’“ warn=” level = ’Warning’“
- 24. detail-syntax=”s: ${source} “ top-syntax=“Hello: ${list}” Hello: s: App1, s: App1, s: App3
- 25. check_pagefile "filter=name= 'total'” check_uptime "warn=uptime < -2d“ "crit=uptime < -1d“ check_processprocess=explorer.exe "warn=working_set> 70m" "detail-syntax=${exe} ws:${working_set}, handles: ${handles}, usertime:${user}s”
- 26. Writing bounds
- 28. C:foobarhelpindex.html Critical if cpubelow 75% Warn if cpubetween 25% and 75% What boundaries are available for check_memory?
- 29. Critical if cpubelow 75% Warn if cpubetween 25% and 75% What boundaries are available for check_memory? C:foobarhelpindex.html nscptest loadCheckSystem
- 30. Critical if cpubelow 75% Warn if cpubetween 25% and 75% What boundaries are available for check_memory? C:foobarhelpindex.html nscptest loadCheckSystem check_cpu”warn=…” check_cpu”warn=…”
- 31. Critical if cpubelow 75% Warn if cpubetween 25% and 75% What boundaries are available for check_memory? C:foobarhelpindex.html nscptest loadCheckSystem check_cpu”warn=loadlt75” check_cpu”warn=loadlt75 and loadgt25”
- 32. Filters
- 33. 5:2 Usingfilters
- 34. C:nsclienthelpindex.html What’s the default filter for check_cpu Check the load of all cores Check only the total page file
- 35. What’s the default filter for check_cpu Check the load of all cores Check only the total page file C:nsclienthelpindex.html nscptest loadCheckSystem
- 36. What’s the default filter for check_cpu Check the load of all cores Check only the total page file C:nsclienthelpindex.html nscptest loadCheckSystem check_cpu”filter=…” show-all check_pagefile”filter=…”show-all
- 37. What’s the default filter for check_cpu Check the load of all cores Check only the total page file C:nsclienthelpindex.html nscptest loadCheckSystem check_cpu”filter=none”show-all check_pagefile”filter=name= ’total’”show-all
- 38. Advancedfilters
- 40. Re-createcheck_eventlogdefaults”as a real command”
- 41. Re-createcheck_eventlogdefaults”as a real command” Check_eventloghelp-short
- 42. Re-createcheck_eventlogdefaults”as a real command” "warn=count > 0“ "crit=count > 5“ "filter=level in ('error', 'warning')" "top-syntax=${status}: ${problem_count}/${count} ${problem_list}“ "detail- syntax=${file} ${source} (${message})“ "perf- syntax=${file}_${source}“ "unique-index=${log}-${source}- ${id}“ scan-rande=-24h file=Application file=System
- 43. "warn=count> 0" "crit=count> 5" "filter=levelin ('error', 'warning')" "top-syntax=${status}: ${problem_count}/${count} ${problem_list}" "detail-syntax=${file} ${source} (${message})" "perf-syntax=${file}_${source}" "unique-index=${log}-${source}-${id}" scan-rande=-24hfile=Applicationfile=System
- 46. check_servicecomputer=192.168.0.1 check_diskdrive=192.168.0.1c$ check_task_schedcomputer=192.168.0.1 check_wmicomputer=192.168.0.1