Check_eventlog - How to override critical-status with ok-status


Hi there, is there any way to override an critical-status with an ok-status ? What I’m trying to do is to return to an ok-status with the occurence of an eventlog-message, after another message generated a critical-status. I tried something like this (via NSClient-WebInterface):

check_eventlog “scan-range=-3d” “filter=provider like ‘TestApp’” “critical=message like ‘Test gestoppt’” “ok=message like ‘Test gestartet’”

According to the documentation

“ok Description: Filter which marks items which generates an ok state. If anything matches this any previous state for this item will be reset to ok”

the expected result would be an ok-state, as soon as the “ok-message” is written to the eventlog - even if the criteria for the critical-state still is valid. But instead the state remains “critical”. Any idea, how to solve this ?

Best regards Olaf