check_eventlog: make using unique index the default

ConSol-Monitoring · Mar 26, 2024 · 3bfca18 · 3bfca18
1 parent 36cc92f
commit 3bfca18
Show file tree

Hide file tree

Showing 3 changed files with 20 additions and 16 deletions.
diff --git a/docs/checks/commands/check_eventlog.md b/docs/checks/commands/check_eventlog.md
@@ -43,10 +43,10 @@ a description of the provided fields.
     check_eventlog
     OK - Event log seems fine
 
-Only return unique events:
+    Return all events, by default only unique events will be returned:
 
-	check_eventlog "detail-syntax=%(id) %(uniqueindex)" "unique-index=1"
-	WARNING - 4 message(s) warning(10010 Application-Microsoft-Windows-RestartManager-10010, 10016 System-Microsoft-Windows-DistributedCOM-10016, 6155 System-LsaSrv-6155, 6147 System-LsaSrv-6147)
+    check_eventlog "detail-syntax=%(id) %(uniqueindex)" "unique-index=0"
+    WARNING - 4 message(s) warning(10010 Application-Microsoft-Windows-RestartManager-10010, 10016 System-Microsoft-Windows-DistributedCOM-10016, 6155 System-LsaSrv-6155, 6147 System-LsaSrv-6147)
 
 ### Example using NRPE and Naemon
 
@@ -79,14 +79,15 @@ Naemon Config
 
 ## Check Specific Arguments
 
-| Argument         | Description                                                                                                              |
-| ---------------- | ------------------------------------------------------------------------------------------------------------------------ |
-| file             | File to read (can be specified multiple times to check multiple files)                                                   |
-| log              | Alias for file                                                                                                           |
-| scan-range       | Sets time range to scan for message (default is 24h)                                                                     |
-| timezone         | Sets the timezone for time metrics (default is local time)                                                               |
-| truncate-message | Maximum length of message for each event log message text                                                                |
-| unique-index     | Combination of fields that identifies unique events, set to 1 to use "\${log}-\${source}-\${id}" or use any other string |
+| Argument         | Description                                                                                                      |
+| ---------------- | ---------------------------------------------------------------------------------------------------------------- |
+| file             | File to read (can be specified multiple times to check multiple files)                                           |
+| log              | Alias for file                                                                                                   |
+| scan-range       | Sets time range to scan for message (default is 24h)                                                             |
+| timezone         | Sets the timezone for time metrics (default is local time)                                                       |
+| truncate-message | Maximum length of message for each event log message text                                                        |
+| unique           | Alias for unique-index                                                                                           |
+| unique-index     | Combination of fields that identifies unique events, set to 0 to disable. Default is "\${log}-\${source}-\${id}" |
 
 ## Attributes
 

diff --git a/pkg/snclient/check_eventlog.go b/pkg/snclient/check_eventlog.go
@@ -18,6 +18,7 @@ func NewCheckEventlog() CheckHandler {
 	return &CheckEventlog{
 		timeZoneStr: "Local",
 		scanRange:   "-24h",
+		uniqueIndex: "1",
 	}
 }
 
@@ -56,7 +57,8 @@ a description of the provided fields.
 			"timezone":         {value: &l.timeZoneStr, description: "Sets the timezone for time metrics (default is local time)"},
 			"scan-range":       {value: &l.scanRange, description: "Sets time range to scan for message (default is 24h)"},
 			"truncate-message": {value: &l.truncateMessage, description: "Maximum length of message for each event log message text"},
-			"unique-index":     {value: &l.uniqueIndex, description: "Combination of fields that identifies unique events, set to 1 to use \"" + DefaultUniqueIndex + "\" or use any other string"},
+			"unique-index":     {value: &l.uniqueIndex, description: "Combination of fields that identifies unique events, set to 0 to disable. Default is \"" + DefaultUniqueIndex + "\""},
+			"unique":           {value: &l.uniqueIndex, description: "Alias for unique-index"},
 		},
 		defaultFilter:   "level in ('warning', 'error', 'critical')",
 		defaultWarning:  "level = 'warning' or problem_count > 0",
@@ -82,10 +84,10 @@ a description of the provided fields.
     check_eventlog
     OK - Event log seems fine
 
-Only return unique events:
+    Return all events, by default only unique events will be returned:
 
-	check_eventlog "detail-syntax=%(id) %(uniqueindex)" "unique-index=1"
-	WARNING - 4 message(s) warning(10010 Application-Microsoft-Windows-RestartManager-10010, 10016 System-Microsoft-Windows-DistributedCOM-10016, 6155 System-LsaSrv-6155, 6147 System-LsaSrv-6147)
+    check_eventlog "detail-syntax=%(id) %(uniqueindex)" "unique-index=0"
+    WARNING - 4 message(s) warning(10010 Application-Microsoft-Windows-RestartManager-10010, 10016 System-Microsoft-Windows-DistributedCOM-10016, 6155 System-LsaSrv-6155, 6147 System-LsaSrv-6147)
 	`,
 		exampleArgs: `filter=provider = 'Microsoft-Windows-Security-SPP' and id = 903 and message like 'foo'`,
 	}

diff --git a/pkg/snclient/check_eventlog_windows.go b/pkg/snclient/check_eventlog_windows.go
@@ -37,7 +37,8 @@ func (l *CheckEventlog) Check(_ context.Context, _ *Agent, check *CheckData, _ [
 	filterUnique := false
 
 	switch l.uniqueIndex {
-	case "":
+	case "", "0", "false", "no":
+		l.uniqueIndex = ""
 	case "1":
 		filterUnique = true
 		l.uniqueIndex = DefaultUniqueIndex