Windows Eventlog - No SendTrap() from Agent
-
Hello,
i'm using hier NetXMS V1.2.7 in a windows environment (NetXMS server is a Win7 machine, NetXMS Agent runs on a Win2008R2 Server). I'm having here a problem with the monitoring from the Windows server. The NetXMS Agent don't send any events to the NetXMS syslog server (syslog server is up an running...)
My agent config looks like this:
--------------------------------------------
MasterServers = 10.10.9.40
ConfigIncludeDir = C:\NetXMS\etc\nxagentd.conf.d
#LogFile = {syslog}
LogFile = c:\netxms\var\netxms.log
FileStore = C:\NetXMS\var
SubAgent = logwatch.nsm
SubAgent = winperf.nsm
DebugLevel = 9*LOGWATCH
Parser = c:\netxms\etc\eventlog_system_parser.xml
--------------------------------------------Logwatch Parser File:
--------------------------------------------
<parser trace="9">
<file>*System</file>
<rules>
<rule>
<match>(.*)</match>
</rule>
</rules>
</parser>
--------------------------------------------With these configs i can see the following in the NetXMS Agent Log:
--------------------------------------------
[28-Apr-2015 15:45:27.877] [DEBUG] [session:0] Sending message CMD_REQUEST_COMPLETED (size 48)
[28-Apr-2015 15:45:43.492] [DEBUG] LogWatch: publisher name is Service Control Manager
[28-Apr-2015 15:45:43.492] [DEBUG] Match event: source="Service Control Manager" id=7036 level=4 text="Dienst "Software Protection" befindet sich jetzt im Status "Beendet"."
[28-Apr-2015 15:45:43.492] [DEBUG] checking rule 1 ""
[28-Apr-2015 15:45:43.492] [DEBUG] rule has no context
[28-Apr-2015 15:45:43.492] [DEBUG] matching against regexp (.*)
[28-Apr-2015 15:45:43.492] [DEBUG] matched
[28-Apr-2015 15:45:43.492] [DEBUG] rule 1 "" matched
[28-Apr-2015 15:45:43.492] [DEBUG] processing stopped at rule 1 ""; result = true
[28-Apr-2015 15:45:48.250] [DEBUG] [session:0] Message dump:
--------------------------------------------By searching for infos on Google i can take a look at other NetXMS Agent Dumps with logwatch active. At all other Dumps i can see an
SendTrap(): event ....
after the line "processing stopped at...". Where is my fault? Can anyone help me, please?
Greets
MarcoPS: By the way, thanx for this great piece of software
-
Hi,
you miss <event> tag in your parser - so there is nothing to send. You should create new event and your parser should look like this:
<parser trace="9">
<file>*System</file>
<rules>
<rule>
<match>(.*)</match>
<event params="1">MY_EVENT</event>
</rule>
</rules>
</parser>Best regards,
Victor -
-
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login