I am trying to get NSCLient++ to work with NSCA to do real-time eventlog checks. It's complicated, so here are my notes. The documentation on this is a bit thin so if there are holes here, comments are welcome. And up front - a shout-out to the NSClient++ lead dev - Michael Medin. He did a lot of work over many years to get the client in the shape its in. This work is based on v5.2.35 of the client.
The real-time log & eventlog system has two parts. I'll call them the filter (or sensor) and the reporter. The filter/sensor decides what events to look for and is configured under these setting headings:
the root heading is not used by me
the /settings/eventlog/real-time heading is used to enable the real-time sensor and set some defauts: