duplicate incident for the same error alert riased by nagios

[bosco]

We are using check_log3 plugin for monitoring the logs fo the servers.log monitoring is working fine but some times raising duplicate incident for the same error alert riased by nagios pluggin

we are getting multiple triggers for same error- that has been logged only once in the log.

below is the check interval time,retrly interval time etc configured in the service check

check_interval 5
retry_interval 1
max_check_attempts 1
notification_interval 0

Details of the incident raised is as below

1659214 PROBLEM: Log file error detected on retail server XXXXX ... Closed Found 53 lines (limit=1/1): 2018 4 18 04:30:21.839 This is a duplicate of 1658826
1659146 PROBLEM: Log file error detected on retail server XXXXX ... Closed Found 53 lines (limit=1/1): 2018 4 18 04:30:21.839 This is a duplicate of 1658826
1659002 PROBLEM: Log file error detected on retail server XXXXX ... Closed Found 53 lines (limit=1/1): 2018 4 18 04:30:21.839 This is a duplicate of 1658826
1658827 PROBLEM: Log file error detected on retail server XXXXX ... Closed Found 53 lines (limit=1/1): 2018 4 18 04:30:21.839 This is a duplicate of 1658826
1658826 PROBLEM: Log file error detected on retail server XXXXX ... Closed Found 53 lines (limit=1/1): 2018 4 18 04:30:21.839 A lot more errors in the log
1658810 PROBLEM: Log file error detected on retail server XXXXX ... Closed Found 13 lines (limit=1/1): 2018 4 18 01:06:07.681 More errors appearing in the log
1658809 PROBLEM: Log file error detected on retail server XXXXX ... Closed Found 5 lines (limit=1/1): 2018 4 18 00:25:25.594 Build up of issues begins

[tgriep]

There are a couple of plugins called check_log3 available, could you post more information on where you found the plugin?
Also, can you post how you are running the plugin and it's options?

Some log plugins use a seek file to keep track of the number of changes to the log file and only test if the pattern is in the changes, make sure the seek file exists and that the nagios user can update it when the plugin runs.

It sounds like the seek file is not getting updated when the plugin runs and it returns the previous check data.

[bosco]

attached is the application used for the monitoring the log.below given is the usage of the pluggin

[/settings/external scripts/scripts]
allow arguments = true
allow_nasty_meta_chars = true
port = 5666
timeout = 900
check_logcontent_POSLogImporter=scripts\check_log3.exe -logfile=d:\DRSApps\logfiles\ -m "*POSLogImporter.txt" -p "File has been moved to" -t most_recent -c 1
;check_logcontent_Tillincoming=scripts\check_log3.exe -logfile=d:\DRSApps\logfiles\ -m "Tillincoming*" -p "Error - Trans :" -t most_recent -c 1

[tgriep]

Without the Seekfile option, the check will always check through the whole file and generate the same output.
Try adding the -s option to the command definition in the nsclient.ini file.

-s, --seekfile=<seekfile|base_dir>
The temporary file to store the seek position of the last scan. If not
specified, it will be automatically generated in $tmpdir, based on the
log file's base name. If this is a directory, the seek file will be auto-
generated there instead of in $tmpdir.

Also, make sure there is not a duplicate nagios process running which could cause the duplicate incidelt.
To stop them, run the following as root on the Nagios server.

Code: Select all

service nagios stop
killall -9 nagios
service nagios start

Thanks.

[bosco]

Thanks for the input

"Without the Seekfile option, the check will always check through the whole file and generate the same output.
Try adding the -s option to the command definition in the nsclient.ini file."

where shouuld i add -s on below commans in nsclient.ini


check_logcontent_POSLogImporter=scripts\check_log3.exe -logfile=d:\DRSApps\logfiles\ -m "*POSLogImporter.txt" -p "File has been moved to" -t most_recent -c 1

[tgriep]

You should be able to put the -s on the end if the command like the example below.

Code: Select all

check_logcontent_POSLogImporter=scripts\check_log3.exe -logfile=d:\DRSApps\logfiles\ -m "*POSLogImporter.txt" -p "File has been moved to" -t most_recent -c 1 -s

Try it out and let us know if you have any further questions.