Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In Nagios it is easy to check that a log message happened in the last 48 hours and sound alarm.

But how can I configure Nagios that it should sound alarm when a message did not occur in the last 48 hours? Why is this so hard?

I'm using the "Check WMI Plus" plugin (no agent required) to check the event log on a windows box.

share|improve this question
Not to go too deep into things I don't use, but most of the Check WMI Plus documentation states that the queries are pretty similar to SQL, what's stopping you from doing a Select and testing the output? If it returns positive, great, if it returns negative, send an alarm. – NickW May 29 '13 at 11:42

I think the question is really about how to structure the WMI query so that it returns true when no results are returned. (I would add "WQL" or "WMI" or both as tags to the question).

One of the best ways to get some experience with WMI querying is to download the WMI Code Creator from Microsoft. Of course you have to run this on a windows box, but you'll be able to zero in on the query you need to feed into the Nagios plugin using the GUI.

The querying language used for WMI is WMI Query Language (WQL), similar to SQL you can query whether a particular eventcode exists within the last 48 hours. Here are some useful links about syntax that is acceptable for WQL.

WQL Keywords: link

WQL Operators: link

WQL Supported Date Formats: link

Namespace: root\CIMV2
Event Class: [depends on what you're looking for specifically]
TargetClass: Win32_NTLogEvent link

You'll be using the most common root\CIMV2 namespace, and the class you'll need is the Win32_NTLogEvent class to obtain the information you're looking for. The rest is just the structure of the query.

Since we don't know which particular event you're looking for there are a couple of properties you can use to change up the query.

Logfile = Which Event log do you want to look in? "Application" or "System" etc...
User = Who generated the event? "NT AUTHORITY\SYSTEM" or maybe you're looking for someone specifically.

You can narrow the query using the WHERE clause, just like in SQL, using the TimeGenerated property. TimeGenerated is in IntervalFormat (or UTC format) link.

Here is a quick guide on working with Dates and Times using WMI. link

WHERE DateDiff("hh",TimeGenerated,GetDate()) < 48

So to put all that together it should look something like this.

SELECT * FROM Win32_NTLogEvent WHERE EventCode=4001 
  AND DateDiff(hh,TimeGenerated,GetDate()) < 48

4001 is just a made-up number, look up the event ID for what you're wanting to query on. ;)

You can add additional AND statements to include properties to narrow the results as needed. This in addition to Phil's answer should get you where you need to be.

share|improve this answer
There is also WMI Tester (Wbemtest.exe) which is a GUI – buckley May 30 '13 at 8:34
Any update on whether the query worked as intended? If you would like to provide more detail I'm sure we can dig deeper if needed. – Lucretius May 31 '13 at 4:58

I don't have a lot of experience with WMI, so I'm not sure how the queries for getting things from the event log go, but assuming you can write that part (and you indicate that you can), you can use Check WMI Plus to set a lower threshold for the number of matching log messages with something like this:

[section check]
query=SELECT * FROM <your query here ...>
display=_DisplayMsg||~|~| - ||
perf=_ItemCount||Log Entries

With that in place, you can run with -c 1: to return a CRITICAL status if there are fewer than one log entries found. (More information about thresholds in Check WMI Plus is at "Can you show me some example warning/critical criteria?".)

share|improve this answer
Didn't have time to check your solution yet but the bounty was ending. Your answer addresses the Nagios part of the question so was the most relevant for me. – buckley Jun 4 '13 at 7:02

It's not hard. You can just combine your typical log check with the standard negate plugin to achieve this.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.