mickem / nscp

NSClient++
http://nsclient.org
GNU General Public License v2.0
239 stars 94 forks source link

check_eventlog returns exit code OK on critical result, if critical check is like "critical= counter < threshold" #671

Open flingo64 opened 4 years ago

flingo64 commented 4 years ago

Issue and Steps to Reproduce

I have a service sending a start and stop event with level 'information' to the application log. Now, I want want to check if the services did show up within the last day, so I use check_eventlog to check whether my service did produce at least two events in the application log.

check_eventlog "filter=file in ('Application') and source in ('myservice') and level in ('information') and written > -1d" "warning=count < 2" "critical=count < 1"

Expected Behavior

Return CRITICAL, if no matching events, Return WARNING if only 1 matching event, Return OK otherwise.

Actual Behavior

While the result test and perfdata is exactly as expected, the exit code is falsely set to OK.

L        cli OK: CRITICAL: No entries found
L        cli  Performance data: 'count'=0;2;1

Details

Additional Details

NSClient++ log (nscp test output):

check_eventlog "filter=file in ('Application') and source in ('myservice') and level in ('information') and written > -1d" "warning=count < 2" "critical=count < 1"
L        cli OK: CRITICAL: No entries found
L        cli  Performance data: 'count'=0;2;1

I checked different variations of the check (e.g. use 'lt' instead of '<', remove 'source in ...' clause, etc.) to make sure I did not do anything stupid, but at the end day when it comes to a less than comparison nscp will say 'CRITICAL' but return OK.