Check_logfiles and criticalthreshold parameter

[jbeaujour]

Hello,
I use check_logfiles with succes two trap CRITICAL message in my log file. Now i want to insert a criticalthreshold in my config file, but it doesn't look to work fine. CRITICAL appears at 1 criticalpatterns reached : i want 5 patterns reached.
here his my config file without criticalthreshold :
@searches = (
{
tag => 'file_linux_stat',
logfile => '$MY_LOGDIR$/$MY_LOGFILE$',
criticalpatterns => ['file different!!'],
okpatterns => 'files ok!',
options => 'noprotocol,noperfdata,report=long,sticky'
}
)

I have pre and post script also
I want a criticalthreshold=5 ant retention of CRITICAL status until "files ok!" appears in log file.
Thanks a lot
Bye

[rkennedy]

I'm not too sure what you mean by the threshold can you provide more clarification? I was able to find this documentation from the ConSol Labs site. Below is an example on how to match multiple patterns -

Code: Select all

@searches = (
  {
    tag => 'san',
    logfile => '/var/adm/messages',
    rotation => 'SOLARIS',
    criticalpatterns => [
        'Link Down Event received',
        'Loop OFFLINE',
        'fctl:.*disappeared from fabric',
        '.*Lun.*disappeared.*'
    ],
  });

Taken from example 1 @ https://labs.consol.de/nagios/check_log ... index.html.

[jbeaujour]

Hello,
I want to apply a threshold before the alert goes into critical. If the "criticalthreshold" parameter is set to 5, it is necessary that at least 5 line of the file contain the pattern "file different!!".

November the 7, file contain 3 line :
20151105 file different!!
20151106 file different!!
20151107 file different!!
With critical trheshold set to 5, there is no CRITICAL

November the 9, file contain 5 line :
20151105 file different!!
20151106 file different!!
20151107 file different!!
20151108 file different!!
20151109 file different!!

There is a CRITICAL alert

Thank's

[rkennedy]

It looks like the parameter you need is

Code: Select all

criticalthreshold=number 	A number which denotes how many lines have to match a pattern until they are considered a critical error.

By setting that, it will work to your needs.

[jbeaujour]

Hello, I tried this parameter, but I can not make it work.

[rkennedy]

Can you post your config file with the criticalthreshold configured?