How do I filter Critical Log alerts in Host & service problems

CMK version:
Ver 2.2
OS version:
Windows 2019

Error message:
Filtering (Unhandled) Service Problems like these:
865 CRIT messages (Last worst: “Aug 30 05:47:24 0.5038 Microsoft-Windows-Security-Auditing Code integrity determined that the image hash of a file is not valid. The file could be corrupt due to unauthorized modification or the invalid hash could indicate a potential disk device error. File Name: \Device\HarddiskVolume1\Program Files\Sophos\Sophos AMSI Protection\SophosAmsiProvider.dll”)

How do I stop error like this from showing and similar ones like it.

Hi @iain.howard

Welcome to the forum!

How do I stop error like this from showing and similar ones like it.

There are multiple ways of answering this question. The question is: What do you want to achieve?

  1. Do you want to silence Checkmk, regardless whether this is a problem or not?
    → Multiple ways of doing that, depending on whether you want this to be more or less permanent.

  2. You want Checkmk to stop bugging you about something that you know is not a problem?
    → Disable the service permanently

  3. You want to solve the underlying problem that Checkmk is telling you about?
    → Acknowledge the problem in Checkmk and do a root cause analysis, ideally identifying the underlying problem and fixing it.

1 Like

In the case of the logwatch service there is the possibility to define log patterns that ignore certain messages.

Probably something like 2 but without disabling notifications for the application log itself.
I need checkMK to parse the error and decide if there is a rule to ignore setup.
If there is a rule to ignore and not notify it does not alert.

Yeah, That’s what I need to do, But how to do it I am not sure.
Is there any docs on that?

Here: Monitoring log files

Unfortunately that Docu link does not tell me anything.

Hi Iain,

looks like the key section that would be important for you is still missing:

As the article mentions, there is the inline help for the service monitoring rule:

Yes, That’s what I have done. I have added 9 log file pattern rules and after the third one it stopped reclassifying the logs alerts for some reason.