Check_Logfiles Plugin Help

[allanhillier]

Hi All,
I'm still working through getting Nagios working correctly on our system here at work. I have been using the Check_Logfiles plugin to monitor /var/log/messages and the Oracle Alert log. I have another log file that I wish to check that has a date stamp on it in its name that changes daily. It is DEBUG_2014_09_16.log today and will be DEBUG_2014_09_17.log and so on and so on. My trouble is how do I set it up in the config file? I tried using the following in my config file with no success. I don't want to have to create a script to handle this I wouldlike to accomplish it in the config file. I searched google relentlessly with no help.


@searches = ({
tag => 'debugalerts',
m= `date +%Y-%m-%d`
logfile => '/tmp/DEBUG_$m.log',
criticalpatterns => [
'Device Error',
'System Error',
],
warningpatterns => [
'Device Stalling ',
]
});


Any ideas would be greatly appreciated.

Thanks,
Allan

[tmcdonald]

You can't assign a variable within an array initialization:

Code: Select all

m= 'date +%Y-%m-%d'

You would need to declare that outside of the @searches array, then reference it inside, like so:

Code: Select all

my $m= 'date +%Y-%m-%d';

@searches = ({
tag => 'debugalerts',
logfile => "/tmp/DEBUG_${m}.log",
criticalpatterns => [
'Device Error',
'System Error',
],
warningpatterns => [
'Device Stalling ',
]
});

Not the double-quotes and curly braces. I have not tested this though - not really sure how the plugin is pulling in the config.

Were you getting any specific errors?

[allanhillier]

Thank you for the fast response. I did as you suggested and I get the following: It is taking $m as being literally 'date +%Y-%m-%d' and not the actual date values.

UNKNOWN - (1 unknown in dcf_log.protocol-2014-09-17-12-26-23) - could not find logfile /tmp/DEBUG_date +%Y-%m-%d.log

[tmcdonald]

Yea, sorry. Out of habit I changed the backticks to single quotes. It should be:

Code: Select all

my $m= `date +%Y-%m-%d`;

[allanhillier]

I'm getting closer, for some reason whatever is after the variable is lopped off. You will notice a line commented out that I would like to be the actual line that runs. When I was trying the full date there were no underscores only dashes so I think I need to break it out into 3 pieces.

UNKNOWN - (1 unknown in dcf_log.protocol-2014-09-17-13-57-14) - could not find logfile /tmp/DEBUG_2014



my $year=`date +%Y`;
my $month=`date +%m`;
my $day=`date +%d`;

@searches = ({
tag => 'dcfalerts',
logfile => "/tmp/DEBUG_${year}.log",
#logfile => "/tmp/DCF_DEBUG_${year}_${month}_${day}.log",
criticalpatterns => [
'Device Error',
'System Error',
],
warningpatterns => [
'Device Stalling ',
]
});

Thanks,
Allan

[tmcdonald]

I'm a bit confused - are you saying that

Code: Select all

logfile => "/tmp/DCF_DEBUG_${year}_${month}_${day}.log",

is not working? That's the part that gets cut off at the year?

If so, just concatenate the three vars together beforehand:

Code: Select all

my $year=`date +%Y`;
my $month=`date +%m`;
my $day=`date +%d`;
my $date = $year . "_" . $month . "_" . $day;

@searches = ({
tag => 'dcfalerts',
logfile => "/tmp/DEBUG_${date}.log",
criticalpatterns => [
'Device Error',
'System Error',
],
warningpatterns => [
'Device Stalling ',
]
});

[allanhillier]

I ended up having to do this to get it to work: I had to use chomp because for some reason when I thought it was lopping off the rest of the string it was in fact putting it on the next line. I stumbled upon this while troubleshooting by printing the variable $logfile:

Before using chomp it would be -
/tmp/DEBUG_2014
_09
_18

By Adding "chomp"-

/tmp/DEBUG_2014_09_18.log


Hope this makes sense, below is my updated config file that works as expected.

my $year=`date +%Y`;
my $month=`date +%m`;
my $day=`date +%d`;

chomp($year);
chomp($month);
chomp($day);

my $logfile="/tmp/DCF_DEBUG_".${year}."_".${month}."_".${day}.".log";

@searches = ({
tag => 'dcfalerts',
logfile => "${logfile}",
criticalpatterns => [
'Device Error',
'System Error',
],
warningpatterns => [
'Device Stalling ',
]
});


Thank you so much for taking the time to help, I'll pay it forward if I see someone with a problem that I can help with.

Allan

[tmcdonald]

Good old chomp saves the day again! I'll close this up now, but don't hesitate to come back with any other questions.