Incorrect Eventlog event status

[hiker_42]

I am using the new 3.8 client. I am monitoring event logs for error level severity. However, "Informational" events are being flagged as error level events for some reason.

Below is my command:

check_nrpe -c CheckEventLog -H 134.239.124.50 -p 5666 -a file="Application" MaxWarn=1 MaxCrit=1 "filter=generated gt -30m AND severity='error'" unique descriptions "syntax=%severity%:%source%: (%count%)" error:Winlogon: (1), eventlog: 1 > critical|'eventlog'=1;1;1;

The Winlogon error that is being reported is actually an Informational event and not an error level status in Windows.

Source: Winlogon EventID: 4004

"The Windows logon process has failed to terminate the currently logged on user's processes."

So either nsclient is not reporting the status correctly or Windows is not displaying an error level when it actually is (which I suppose could be the case).

[mickem]

There is two kinds of severity (check the docs) please add both to the syntax string and let me know what it say...

[mickem]

closing as no update for a while now...