Cheshire Cat Computing

I installed the agens on a windows 2003 sbs server.

I removed all filters and made a filter which should only send de error of the applicationlogs to the navision server.
But also informational messages are send to the server as an critical.

This are the registry settings of the filter:




[HKEY_LOCAL_MACHINE\SOFTWARE\Cheshire Cat\Nagios]
"maxFilter"=dword:00000004

[HKEY_LOCAL_MACHINE\SOFTWARE\Cheshire Cat\Nagios\Filter4]
"filterDesc"="Application Eventlog"
"eventLog"=dword:00000001
"eventLogName"="Application"
"serviceName"="Application Eventlog"
"ID"=""
"matchString"=""
"source"=""
"Information"=dword:00000000
"status"=dword:00000002
"Warning"=dword:00000000
"Error"=dword:00000001
"Audit Success"=dword:00000000
"Audit Failure"=dword:00000000
"notID"=dword:00000000
"notMatch"=dword:00000000
"notSource"=dword:00000000

Is says filter4, but it is the only filter.

Regards,

Eric

This certainly looks like it should only match error status Application log events.

Can you tell me which version of the agent you are using?

You can also set the agent into 'debug' mode (there is a check box in the config tool) so that it will tell you what is matching and why, this may help.

Can you also give me the info on the event from the eventlog which is apparently matching, and the Nagios alert message sent?

_________________
Steve Shipway
UNIX Systems, ITSS, University of Auckland, NZ
Woe unto them that rise up early in the morning... -- Isaiah 5:11

It does only send informational messages with id 1018 en 1028.
I'm using version 1.9

the message in nagios is:
SERVICE ALERT: E-HTWSBS01; Application Eventlog: CRITICAL;HARD;1;Application [POP3 Connector #1028]: Access was granted to the mailbox ......... logging on as ........@...........