This check does the following tasks:

check, if interesting messages are in the eventlog. Note: "psloglist" command is used for this check, please make sure that your installation of pstools is in path variable

EVENTLOG

Explanation

EVENTLOG is the enclosing tag for the eventlog check

Parent

OSAGENT

allowed values

• CLASS

Count

1

Example

<EVENTLOG>
  <CLASS>
    <NAME>APPLICATION</NAME>
    <LOGFILTER><REGEX>subsystem started</REGEX></LOGFILTER>
    <LOGFILTER><REGEX>.*</REGEX><ERRORLEVEL>WARNING</ERRORLEVEL></LOGFILTER>
  </CLASS>

  <CLASS>
    <NAME>SECURITY</NAME>
    <LOGFILTER><REGEX>user .* loggod on</REGEX></LOGFILTER>
    <LOGFILTER><REGEX>.*</REGEX><ERRORLEVEL>WARNING</ERRORLEVEL></LOGFILTER>
  </CLASS>
</EVENTLOG>
        

CLASS

Explanation

For every log class you want to check, define a CLASS-pair

Parent

EVENTLOG

allowed values

• CLASS

• LOGFILTER

Count

As many as you like.

Example

Look at EVENTLOG

CLASS

Explanation

select your log classes

Parent

EVENTLOG

allowed values

• a valid log class (look at the event viewer)

Count

1

Example

Look at EVENTLOG