Windows 2025 service eventlogs not working

[nielsalkema]

Hello,

First-time installation of the Icinga2 client on Windows Server 2025, and the service check for event logs is not working.
(All other checks are working fine.)

Plugin Output

UNKNOWN - (2 unknown) - 2026-03-20T08:03:08 0000 CHECK_LOGFILES INTERNAL ERROR open Eventlog The RPC server is unavailable. ...

tag application UNKNOWN

2026-03-20T08:03:08 0000 CHECK_LOGFILES INTERNAL ERROR open Eventlog The RPC server is unavailable.

tag system UNKNOWN

2026-03-20T08:03:08 0000 CHECK_LOGFILES INTERNAL ERROR open Eventlog The RPC server is unavailable.

Information from the Window server

*******************************************
** Icinga for Windows Management Console **
** Copyright (c) 2025 Icinga GmbH | MIT  **
**    User environment AD\mgenouxadm     **
**  Icinga PowerShell Framework v1.14.1  **
*******************************************
 
Icinga for Windows environment overview:
 
 
Environment configuration:
 
PowerShell Root                 => C:\Program Files\WindowsPowerShell\Modules\
Icinga for Windows Service Path => C:\Program Files\icinga-framework-service
Icinga for Windows Service User => NT Authority\NetworkService
Icinga for Windows Service Pid  =>
Icinga for Windows JEA Pid      =>
Icinga Agent Path               => C:\Program Files\ICINGA2\
Icinga Agent User               => NT Authority\SYSTEM
Defined Default User            => NT Authority\NetworkService
Icinga Managed User             => False
PowerShell Version              => 5.1.26100.32522
Operating System                => Microsoft Windows Server 2025 Standard
Operating System Version        => 10.0.26100
JEA Context                     =>
JEA Session File                =>
Api Check Forwarder             => True
Debug Mode                      => False
 
Icinga for Windows Certificate:
 
Issuer  => CN=Icinga CA
Subject => CN=testw2025.ad.unil.ch
 
List of configured background daemons on this system:
 
Start-IcingaWindowsRESTApi
-----------
No arguments defined
 
List of configured background service checks on this system:
=> https://icinga.com/docs/icinga-for-windows/latest/doc/110-Installation/06-Collect-Metrics-over-Time/
 
No background service checks configured
 
List of configured repositories on this system. The list order matches the apply order:
 
Icinga Stable
-----------
CloneSource  =>
Enabled      => True
LocalPath    =>
Order        => 0
RemotePath   => https://packages.icinga.com/IcingaForWindows/stable/ifw.repo.json
UseSCP       => False
 
Installed components on this system:
 
Component    Version   Available
---          ---       ---
agent        2.15.2    2.15.2
framework    1.14.1    1.14.1
 
Available versions flagged with "*" mean that this component is locked to this version
 
[x] Exit [c] Continue [h] Help [l] Commands [m] Main [p] Previous
 
Input (Default c) (1/1):

[julianbrost]

the service check for event logs

Sounds like this is referring to Invoke-IcingaCheckEventlog, so I moved this to the appropriate project.

[LordHepipud]

Hello

Thank you for the issue. The plugins shipping with the Icinga Agent are deprecated.
Could you please try to intstall Icinga for Windows (the PowerShell components) and try with the Invoke-IcingaCheckEventlog check?

You can have a look on the Installation Docs

[julianbrost]

The plugins shipping with the Icinga Agent are deprecated.

Icinga 2 doesn't ship such a plugin. Here's the list of (deprecated) plugins installed with v2.15.2: https://github.com/Icinga/icinga2/tree/v2.15.2/plugins

Given the output from the Icinga PowerShell Framework, I assumed that this must have been about these plugins. If @LordHepipud now says that's not an output from Invoke-IcingaCheckEventlog either, I don't know where it's coming from.

@nielsalkema Can you please share the related configuration (Service and CheckCommand objects). Though I now have the feeling this isn't even a check plugin provided by Icinga itself.

[nielsalkema]

@julianbrost For our eventlogs service we use https://omd.consol.de/docs/plugins/check_logfiles/

'C:\Program Files\ICINGA2\/sbin/check_logfiles' '--config' 'c:\ProgramData\icinga2\var\spool\icinga2\check_logfiles.cfg' '--maxlength' '8192' '--noperfdata' '--noprotocol' '--report' 'long' '--winwarncrit'

[LordHepipud]

Thank you for the clarification. Sadly, we cannot provide any fixes for the plugins from consol.

There would be several options:

• Reach out to them for troubleshooting and fixing the plugin
• Use the Icinga for Windows PowerShell plugins for monitoring your Windows machines and eventlog

If you require support/assistance/consulting services to assist you with this, you can also reach out to NETWAYS which is an Enterprise Icinga partner.
They provide remote consulting/outsourcing services.

[LordHepipud]

By the way, if another partner in a different area fits you better, you can also have a look on all the other partners: Icinga Partners