Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.


Info

This article explains how to enable the Event Console within Checkmk.

Status
colourGreen
titleLAST TESTED ON CHECKMK 2.03.0P1


Panel
borderColorblack
bgColor#f8f8f8
titleTable of Contents

Table of Contents

Getting Started

Background information regarding this subject is available on our:


Overview

The Event Console (EC) is a very powerful tool to receive and process incoming events. While in the past, this might have been mainly SNMP traps (the classic), EC is also a very powerful way to monitor log files.

...

The following graphic shows the way that theĀ Eventlog data is using from the source to the destination:

Image RemovedScreenshot of the event console flow from the windows event log into cmk server.Image Added


Basic Event Console Configuration

...

First, we have to enable the Event Console. How to achieve that , depends on the kind of server you have.

...

Use the Webconf to enable the Event Console:

Image RemovedScreenshot of the location of the edit button within the site management section of the Checkmk appliance.Image Added

Image RemovedScreenshot of site configuration with enable processing of external messages enabled.Image Added

If you only want to process log files, you can leave the syslog/SNMP trap options unticked.

Common Checkmk Server (i.e., installed on a self-hosted Linux)

Use "omd config" from the command line to enable the Event Console:

Image Removed

...

Screenshot of configuration of mysite with addons selected.Image Added Screenshot of addons section with mkeventd set to on.Image Added


If you only want to process log files, you can leave the syslog/SNMP trap options off.

...

Without having any rule packs and rules in the Event Console, all incoming events would simply be dropped. For debugging and to get started with the Event Console, we recommend to enable the message archiving in Setup/Events/Event Console:

Image RemovedScreenshot of event console rule packs. Location of settings button.Image Added

Image RemovedScreenshot fo the event console configuration matching rule. Force message archiving enabled.Image Added


After activating this option and activating the changes, all events (that do not match any rules) will be put into the event archive and can be watched in the view "Recent Event History".

...

Filter by label (Content by label)
showLabelsfalse
max5
spacesKB
showSpacefalse
sortmodified
reversetrue
typepage
cqllabel = "securityevent_console" and type = "page" and space = "KB"
labelssecurity

...