I am trying to detect an eventlog entry on a server, so am trying to use the CheckEventLog command:

./check_nrpe -H hostname -c CheckEventLog -a MaxWarn=1 MaxCrit=1 "filter=generated gt -3d AND id=23 AND source='mpio'" truncate=800 unique "syntax=%severity%: %source%: %id%: %message% (%count%)"

But, I always get an error back from the client:

Exception processing request: Request command contained illegal metachars!

I have set the option to allow nasty meta chars, but that doesn't seem to help.

allow arguments = true
allow_nasty_meta_chars = 1

If I take out the source part of the filter, it works, but of course event id's are not unique in themselves.


The nsclient.ini file is not the same as the old nsc.ini so keys and values have changed not just sections.

The key name for "nasty chars" is:

allow nasty characters=true

[/settings/external scripts]
allow nasty characters=true


  • Gah! Perfect. It was the underscores in the key names. I must have found an old example on the internet, and after that not spotted the difference. Thanks!
    – Cylindric
    Aug 27 '14 at 8:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.