Comments on: check_logfiles

By: lausser

lausser — Thu, 11 Mar 2010 11:08:58 +0000

By default it will be in the directory /var/tmp/check_logfiles (unless you specify another directory with the $seekfilesdir parameter). The filename of the seekfile is composed from the tag and the logfile’s name.

By: Steven

Steven — Wed, 10 Mar 2010 17:10:56 +0000

"In principle check_logfiles scans a log file until the end-of-file is reached. The offset will then be saved in a so-called seekfile. The next time check_logfiles runs, this offset will be used as the starting position inside the log file"

Where is this so-called seekfile ? I want to delete it during my tests...

By: lausser

lausser — Fri, 05 Mar 2010 10:49:09 +0000

Did you copy&paste the error message to your comment? I see a strange character here: ….Unknown option: ûcriticalexception …

The –criticalexception does work, i just doublechecked it. Please try it again.

check_logfiles.exe --logfile "test.log" --criticalpattern "Error" --criticalexception "Invalid credentials"

Please type the comand yourself, do not copy&paste from this website. I have a suspicion that wordpress messes up the page contents (as it does with the double-dash)

By: Ruben

Ruben — Fri, 05 Mar 2010 10:17:48 +0000

Hi,

thanks a lot for your plugin, it’s very useful. I have a problem with the Windows version plugin: if I execute it with the “criticalexception” param, I get an error message that says “Unknown option”. You have below the whole error message.

Best regards.

C:\ARCHIV~1\NAGIOS~1\plugins>check_logfiles.exe --logfile="test.log" --criticalpattern="Error" --criticalexception="Invalid credentials" Unknown option: ûcriticalexception This Nagios Plugin comes with absolutely NO WARRANTY. You may use it on your own risk! Copyright by ConSol Software GmbH, Gerhard Lausser.

This plugin looks for patterns in logfiles, even in those who were rotated since the last run of this plugin.

You can find the complete documentation at http://www.consol.com/opensource/nagios/check-logfiles or http://www.consol.de/opensource/nagios/check-logfiles

Usage: check_logfiles [-t timeout] -f

The configfile looks like this:

$seekfilesdir = '/opt/nagios/var/tmp';

where the state information will be saved.

$protocolsdir = '/opt/nagios/var/tmp';

where protocols with found patterns will be stored.

$scriptpath = '/opt/nagios/var/tmp';

where scripts will be searched for.

$MACROS = { CL_DISK01 => "/dev/dsk/c0d1", CL_DISK02 => "/dev/dsk/c0d2" };

@searches = ( { tag => 'temperature', logfile => '/var/adm/syslog/syslog.log', rotation => 'bmwhpux', criticalpatterns => ['OVERTEMP_EMERG', 'Power supply failed'], warningpatterns => ['OVERTEMP_CRIT', 'Corrected ECC Error'], options => 'script,protocol,nocount', script => 'sendnsca_cmd' }, { tag => 'scsi', logfile => '/var/adm/messages', rotation => 'solaris', criticalpatterns => 'Sense Key: Not Ready', criticalexceptions => 'Sense Key: Not Ready /dev/testdisk', options => 'noprotocol' }, { tag => 'logins', logfile => '/var/adm/messages', rotation => 'solaris', criticalpatterns => ['illegal key', 'read error.$CL_DISK01$'], criticalthreshold => 4 warningpatterns => ['read error.$CL_DISK02$'], } );

C:\ARCHIV~1\NAGIOS~1\plugins>

By: lausser

lausser — Thu, 04 Mar 2010 15:11:12 +0000

If you use the option report=long, then the tag is also shown in the output. Tag and logfile are available as environment variables to handler scripts. Something like this is possible:

@searches = ({
    tag => 'xyxy',
    logfile => 'xyxy.log',
    options => 'supersmartscript',
    script => sub {
      printf "%s - %s - %s\n",
          $ENV{CHECK_LOGFILES_TAG},
          $ENV{CHECK_LOGFILES_LOGFILE},
          $ENV{CHECK_LOGFILES_SERVICEOUTPUT};
      return $ENV{CHECK_LOGFILES_SERVICESTATEID};
    },
   ....

This adds tag and current logfile as prefix to the matched lines. Of course, this will bloat your output. Alternatively you might have a look at supersmartpostscript. (See the examples page).

By: JK

JK — Thu, 04 Mar 2010 14:26:25 +0000

Thank you for that great plugin. I have one issue: Is it possible to include the tag and logfile parameter in the output of the plugin?

By: Derek

Derek — Tue, 02 Mar 2010 21:12:28 +0000

@lausser,

ah, cool, thanks. replied b4 I saw that you had already.

By: lausser

lausser — Tue, 02 Mar 2010 21:12:09 +0000

If you expect situations where no valid logfile exists, you need to set options=>'nologfilenocry' to suppress the UNKNOWN.

By: lausser

lausser — Tue, 02 Mar 2010 21:07:14 +0000

check_logfiles already handles the weirdest situation, guessing filenames or finding logfiles by regular expression alas is beyond the scope of this tool. What you can do:

The configfile is simply a piece of perl-code. Why not write

code...code...code
$logfile = what i found to be the current logfile;
@searches = ({
....
  logfile => $logfile,
  options => 'allyoucaneat', #start from the beginning
....
});

An alternative would be rotating::uniform. (look above in these comments, there already is an example)

$tracefile = 'a file where debugging will be written to';
@searches = ({
  type => 'rotating::uniform',
  # a dummy logfile entry. it is used only because it
  # shows the plugin which directory to look in
  logfile => '/home/edwinst....backuplog/i_dont_exist',
  # now the pattern for rotated files (in ..../backuplog)
  rotation => 'db2backup_dw_prd\d+_\d{8}_\d+\.log',
  criticalpatterns => '........
});

Now always the newest logfile is considered the current, active logfile and all the others are considered rotated archives.

Create the tracefile with the touch-command and watch it’s contents with tail -f.

Play around with it, it should work.

By: Derek

Derek — Tue, 02 Mar 2010 21:06:37 +0000

Did this but it still gets an UNKNOWN error if there are no valid log files. I "think" it works other than that... See issues?

$scriptpath = '/pkgs/linux/intel/nagiosplug/et0.1/libexec'; @searches = (); foreach my $logfile (glob '/home/edwinst1/scripts/logs/backuplog/db2backup_dw_prd1_*.log') { next if (-M "$logfile" > 8); push(@searches, { tag => basename($logfile), logfile => $logfile, options => 'protocol,count', criticalpatterns => ['ERROR','DB2\sbackup.+failed'] }); } 1;