How to monitor Windows Server events with Centreon Nagios

Windows Server has a built in SNMP trap generator for the Windows Event Log/Viewer, which can send traps on the occurrence of arbitrary events.

Trap Form (OID)

These traps will conform to the Microsoft private enterprise MIB branch in the following form:

1.3.6.1.4.1.311.1.13.X.n.n.n.n.n.n.n.n.n... 

Each "n" is a decimal encoding of an ASCII character octet from the Event Log source name, and the X designates the number of characters to follow.

So, for example, a trap generated by source "Prefect" (as seen in Event Viewer) would appear as:

1.3.6.1.4.1.311.1.13.7.80.114.101.102.101.99.116 

Windows 2000 Server does not support this fully, and will generate traps of a slightly different format, but the procedure is otherwise identical. All newer versions of Windows server support this properly

Configuring Trap Sending

There are two built-in tools that you will use to set up trap generation.

evntwin: Create mapping of Event Log messages to SNMP traps evntcmd: Load mapping created by evntwin so that traps are generated

Run evntwin from a command prompt: this will spawn a GUI. Select "Custom" under Configuration type, and then "Edit." You will now see a list of all possible event sources. Under the source in which you are interested, select the particular event ID on which you wish to generate traps. Then, click "Add."

Now, you will see the actual OID of the trap, the specific ID, and an option to set a time-based threshold of event occurrences before the trap would be sent.

Repeat until you have created a mapping for each particular trap/event combination you care about. Then, click "Apply," highlight all of the mappings, and then "Export..." Save the file, and exit the application.

Now, again from the command line, run evntcmd, specifying the name of the file you just created:

evntcmd myeventfile.cnf

From this point forward, the events you specified will generate SNMP traps, which will be sent to all trap receiver destinations you have configured in your SNMP service settings. Process them as you would any normal SNMP trap.

An admin who doesn't monitor the event logs (or equivalent an non-Windows systems) is not much of an admin. However, there are many different ways and means of monitoring the logs and because they are cryptic at best the monitoring is best done programatically. That doesn't remove the need for periodic random manual checks but certainly makes a large complex job manageable.

The key to this is a program (or suite of programs) that will pares the logs and extract the "interesting" bits. e.g. Why would we normally care that Betty sent a 50 page document to the Accounts HP printer, yet the logs are chock full of such stuff. The vast majority of event log entries are of no real concern to the day to day operation but can be very helpful when trying to isolate or debug problems.

Use the filter extract the errors and warnings and then possibly even drop those that are normal and expected on a given system. Once you get this filtered down properly you should end up with a reasonably small number of events that require further investigation. Or at least one would hope that is the result.