{"action":"reopened","issue":{"url":"https://api.github.com/repos/mickem/nscp/issues/204","repository_url":"https://api.github.com/repos/mickem/nscp","labels_url":"https://api.github.com/repos/mickem/nscp/issues/204/labels{/name}","comments_url":"https://api.github.com/repos/mickem/nscp/issues/204/comments","events_url":"https://api.github.com/repos/mickem/nscp/issues/204/events","html_url":"https://github.com/mickem/nscp/issues/204","id":117016695,"number":204,"title":"0.5.0.17 => Real-time eventlog filters issue?","user":{"login":"willemdh","id":6462991,"avatar_url":"https://avatars.githubusercontent.com/u/6462991?v=3","gravatar_id":"","url":"https://api.github.com/users/willemdh","html_url":"https://github.com/willemdh","followers_url":"https://api.github.com/users/willemdh/followers","following_url":"https://api.github.com/users/willemdh/following{/other_user}","gists_url":"https://api.github.com/users/willemdh/gists{/gist_id}","starred_url":"https://api.github.com/users/willemdh/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/willemdh/subscriptions","organizations_url":"https://api.github.com/users/willemdh/orgs","repos_url":"https://api.github.com/users/willemdh/repos","events_url":"https://api.github.com/users/willemdh/events{/privacy}","received_events_url":"https://api.github.com/users/willemdh/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/mickem/nscp/labels/bug","name":"bug","color":"fc2929"}],"state":"open","locked":false,"assignee":{"login":"mickem","id":1434697,"avatar_url":"https://avatars.githubusercontent.com/u/1434697?v=3","gravatar_id":"","url":"https://api.github.com/users/mickem","html_url":"https://github.com/mickem","followers_url":"https://api.github.com/users/mickem/followers","following_url":"https://api.github.com/users/mickem/following{/other_user}","gists_url":"https://api.github.com/users/mickem/gists{/gist_id}","starred_url":"https://api.github.com/users/mickem/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mickem/subscriptions","organizations_url":"https://api.github.com/users/mickem/orgs","repos_url":"https://api.github.com/users/mickem/repos","events_url":"https://api.github.com/users/mickem/events{/privacy}","received_events_url":"https://api.github.com/users/mickem/received_events","type":"User","site_admin":false},"milestone":{"url":"https://api.github.com/repos/mickem/nscp/milestones/4","html_url":"https://github.com/mickem/nscp/milestones/0.5.0","labels_url":"https://api.github.com/repos/mickem/nscp/milestones/4/labels","id":1400278,"number":4,"title":"0.5.0","description":"","creator":{"login":"mickem","id":1434697,"avatar_url":"https://avatars.githubusercontent.com/u/1434697?v=3","gravatar_id":"","url":"https://api.github.com/users/mickem","html_url":"https://github.com/mickem","followers_url":"https://api.github.com/users/mickem/followers","following_url":"https://api.github.com/users/mickem/following{/other_user}","gists_url":"https://api.github.com/users/mickem/gists{/gist_id}","starred_url":"https://api.github.com/users/mickem/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mickem/subscriptions","organizations_url":"https://api.github.com/users/mickem/orgs","repos_url":"https://api.github.com/users/mickem/repos","events_url":"https://api.github.com/users/mickem/events{/privacy}","received_events_url":"https://api.github.com/users/mickem/received_events","type":"User","site_admin":false},"open_issues":16,"closed_issues":14,"state":"open","created_at":"2015-11-08T19:15:07Z","updated_at":"2016-03-03T13:04:27Z","due_on":"2016-01-31T23:00:00Z","closed_at":null},"comments":28,"created_at":"2015-11-15T20:45:07Z","updated_at":"2016-03-03T13:04:27Z","closed_at":null,"body":"Hello,\r\n\r\nJust did some tests with the real-time eventlog component of NSClient++ 5.0.9 and noticed that my filters seem never matched. This is the filter i'm using as test:\r\n```\r\n[/settings/eventlog/real-time]\r\nstartup age = 30m\r\nenabled = 1\r\nlog = application,system\r\ndebug = 1\r\n[/settings/eventlog/real-time/filters]\r\n\r\n[/settings/eventlog/real-time/filters/default]\r\ndestination = NSCA\r\nmaximum age = 2h\r\nok message = Found no records in eventlog last two hours.\r\nsyntax = %type% %id% %source%: %message% \r\n\r\n[/settings/eventlog/real-time/filters/EVT_Application]\r\nlog= application\r\nfilter= level IN (error) AND (id NOT IN (1,3))\r\nseverity= WARNING\r\n```\r\nWhen I create an error in the application eventlog with this Powershell command:\r\n```\r\nwrite-eventlog -logname Application -source Test -id 6005 -Message test -EntryType Error\r\n```\r\nthe following appears in the nsclient console test modus:\r\n```\r\nD   eventlog Reading eventlog messages...\r\nD   eventlog Processing: 000000BFE1A56830\r\nD   eventlog No filters matched an event\r\nD   eventlog Next miss time is in: no timeout specified\r\nD   eventlog Sleeping for: 4294967295ms\r\nD   eventlog Reading eventlog messages...\r\nD   eventlog Processing: 000000BFE1A56830\r\nD   eventlog No filters matched an event\r\nD   eventlog Next miss time is in: no timeout specified\r\nD   eventlog Sleeping for: 4294967295ms\r\n```\r\nI also see this in the nsclient.log:\r\n```\r\n2015-11-15 22:08:31: debug:c:\\source\\master\\include\\parsers/filter/realtime_helper.hpp:148: No filters matched an event\r\n2015-11-15 22:08:31: debug:c:\\source\\master\\include\\parsers/filter/realtime_helper.hpp:165: Realtime processing faillure\r\n2015-11-15 22:08:31: error:c:\\source\\master\\include\\parsers/filter/realtime_helper.hpp:187: Invalid duration for eventlog check, assuming all values stale\r\n2015-11-15 22:08:31: debug:c:\\source\\master\\include\\parsers/filter/realtime_helper.hpp:199: Next miss time is in: 300s\r\n```\r\nI know for sure this works in 0.4.1.105 so is there something changed in the syntax, is there a bug or am I missing something?\r\n"}}