BUG REPORT: check_eventlog_windows fails often with exception

[Stefan-Hoesl]

Describe the bug
The SNClient is queried with check_nsc_web:

check_nsc_web -p 'XxXxXxXxX -t '20:OK' -u 'https://SNClient' 'check_eventlog' 'log=System' 'filter=id=41 or id=6008'

This query fails very often but sometimes we get a result. We already set the Timeout to 2min without success.

In the SNClient.log on the Windows Server I can see the following error:

[2026-02-10 04:19:50.812][Warn][pid:14768][check_eventlog_windows:49] eventlog query failed, file: Security: wmi query failed: Exception occurred. (Quota violation )
[2026-02-10 04:25:20.585][Warn][pid:14768][check_eventlog_windows:49] eventlog query failed, file: Security: wmi query failed: Exception occurred. (Quota violation )
[2026-02-10 04:57:50.803][Warn][pid:14768][check_eventlog_windows:49] eventlog query failed, file: Security: wmi query failed: Exception occurred. (Call cancelled )
[2026-02-10 06:03:00.118][Warn][pid:14768][check_eventlog_windows:49] eventlog query failed, file: Security: wmi query failed: Exception occurred. (Call cancelled )
[2026-02-10 06:19:17.804][Warn][pid:14768][check_eventlog_windows:49] eventlog query failed, file: Security: wmi query failed: Exception occurred. (Quota violation )
[2026-02-10 07:13:38.716][Warn][pid:14768][check_eventlog_windows:49] eventlog query failed, file: Security: wmi query failed: Exception occurred. (Call cancelled )
[2026-02-10 08:02:22.905][Warn][pid:14768][check_eventlog_windows:49] eventlog query failed, file: Security: wmi query failed: Exception occurred. (Call cancelled )
[2026-02-10 08:13:14.092][Warn][pid:14768][check_eventlog_windows:49] eventlog query failed, file: Security: wmi query failed: Exception occurred. (Call cancelled )
[2026-02-10 09:02:03.777][Warn][pid:14768][check_eventlog_windows:49] eventlog query failed, file: Security: wmi query failed: Exception occurred. (Quota violation )
[2026-02-10 09:51:02.107][Warn][pid:14768][check_eventlog_windows:49] eventlog query failed, file: Security: wmi query failed: Exception occurred. (Quota violation )
[2026-02-10 10:07:17.141][Warn][pid:14768][check_eventlog_windows:49] eventlog query failed, file: Security: wmi query failed: Exception occurred. (Call cancelled )
[2026-02-10 10:45:22.311][Warn][pid:14768][check_eventlog_windows:49] eventlog query failed, file: Security: wmi query failed: Exception occurred. (Quota violation )

To Reproduce
Steps to reproduce the behavior:

Use this Query:

check_nsc_web -p 'XxXxXxXxX -t '20:OK' -u 'https://SNClient' 'check_eventlog' 'log=System' 'filter=id=41 or id=6008'

Expected behavior
Get results

Screenshots
If applicable, add screenshots to help explain your problem.

Software (please complete the following information):

• OS Windows Server 2016-2025
• Architecture x86
• SNClient Version v0.36

Additional context
Add any other context about the problem here.

[Stefan-Hoesl]

It seems like only the WMI Query for the Security Eventlog causes the problem.
After a SNClient restart it works for a short time and then stops working after a short time.
If this happens also the check_network runs into timeout.