Nagios Log monitoring ...

[rmank]

Hello ,

We are trying to setup a monitoring of few log files against FS error on via NRPE /NAgios XI

Enviroment ..Nagios XI with RHEL host

Need :Need to produce alerts when if there are some specific strings indentified in log file

I could see only check_log plugin in libexec directory .So your help will be highly appreciated in the context

-->Is there a new plugin needed for that (if yes where can i ?)
-->else how can i test it with nrpe and some some commands

thanks alot ..

[rkennedy]

The check_log plugin should work for you. You'll need to define a command in your NRPE configuration that utilizes the check_log file.

As an example, this would check for the word xinetd in your syslog.

Code: Select all

command[check_syslog]=sudo /usr/lib/nagios/plugins/check_log -F /var/log/messages -O /tmp/templog.log -q xinetd

[rmank]

Thanks for the details .Can you do this for Windows also ?
Also is there a way to get the eventviewer log size settings for windows using CLI via nrpe /nsc ?

[hsmith]

Check this guide out for monitoring Windows Logs with NSClient: https://outsideit.net/real-time-eventlog-monitoring/

Also is there a way to get the eventviewer log size settings for windows using CLI via nrpe /nsc ?

I'm not entirely sure what you're looking for, can you provide a little more detail?

[rmank]

thanks a lot 'hsmith'

when I say details about event viewer ,I am looking like the assigned size for event viwer and used + if the log rotation automatic override parameter is enabled ?

[hsmith]

I am looking like the assigned size for event viwer

Could you please elaborate on this a bit more?

+ if the log rotation automatic override parameter is enabled ?

Are we still talking about the Windows event log? The link that I provided is for Windows event logs.

[rmank]

I am looking for a way to check the log size now and if that is exceeded than maximum log size ? and does the overwrite events option is enabled ?

[rkennedy]

Can you clarify what exactly you would like to do when it reaches that max log size?

[rmank]

It should trigger an alert ...

[rkennedy]

You will need to create a new check for that then, the options there are not for alerts, but rather what to do when the log file fills up. I would change that to 'Do not overwrite events' and setup a new check over NRPE using this plugin -
https://exchange.nagios.org/directory/P ... ck/details