Importing Files?

[joshua.tilson]

I am looking for a simple way to Upload a single log file to Nagios Log Server.

I know there is a very detailed write up on how to do this with Linux, and netstat and python, and I'll be honest I don't do a lot of any of those, so to me it is overly complicated, and apparently I am not doing it right.

I have Dowloaded the Python script, I have uploaded the .log files onto the Nagios Log Server, this is the only Linux machine I manage and I have run the following command:

cat logons.log | python shipper.py | nc 192.168.80.221 2057

It sat for 5 minutes, then. . .nothing, no errors, no logs.

each line of the logfile is a new entry and looks like this:

logon: Mon 04/10/2017; 14:09:01.96; User; Server; Domain;

Can some one please help me decipher how to parse this file?

alternatively I was hoping for a little button on the Admin web interface that said "Upload Logfile". . .

Thanks!

[cdienger]

Does it just sit there for 5 minutes before bring you back to the command line? How large is the file? Any weird output if you just print the file to the screen with:

Code: Select all

cat logons.log | python shipper.py

or can you telnet to the ip/port ?

Code: Select all

telnet 192.168.80.221 2057

Also, make sure the port is up and listening on the NLS sever with:

Code: Select all

netstat -na | grep 2057

There should also be an input configured in the web UI with the following settings:

Code: Select all

tcp {
    type => 'import_json'
    tags => 'import_json'
    port => 2057
    codec => json
}

[joshua.tilson]

My reply apparently got lost yesterday afternoon,


The file is only 7mb.

The CAT command returns lines like this one:

Code: Select all

{"message": "logon: Tue 12/05/2017  7:36:14.13; USER; SERVER; DOMAIN;  \r\n"}

I cannot successfully telnet to the server on that port, I am however running this commands ON the server as it is the only linux machine I currently have access to.

and netstat returns the following

Code: Select all

tcp        0      0 :::2057                     :::*                        LISTEN
tcp        0      0 ::ffff:192.168.80.221:2057  ::ffff:192.168.80.63:54767  ESTABLISHED

And i do have the input configured.

perhaps it is the location or way I formatted my command?

[mcapra]

alternatively I was hoping for a little button on the Admin web interface that said "Upload Logfile". . .

+1 for this as a feature.

[kyang]

joshua.tilson,

joshua.tilson wrote:
alternatively I was hoping for a little button on the Admin web interface that said "Upload Logfile". . .

Did you want me to put that into a feature request?

[joshua.tilson]

Also, did you want me to put that into a feature request?

I mean it seems like a good idea to me. I am sure others are struggling with this concept as well, I like to think I am technically competent, but nothing like a good old linux box to make you question your sanity!

[kyang]

Sounds good!

Also, when you did try using the shipper.py command. Did anything show up in the dashboards? Or nothing during the 5-minute wait?

Code: Select all

cat logons.log | python shipper.py | nc 192.168.80.221 2057

Are you able to send a string?

Code: Select all

echo 'test words' | nc 192.168.80.221 2057

Then go to your dashboard (if you got a lot of logs you could query for test words) to see if it's there.

[joshua.tilson]

Some of this is my own lack of knowledge on how to properly use the product.

I tested the Test Words, and it showed up instantly! I realize that I was looking in the wrong place, Test words shows up under a new host 192.168.80.221 on the log server.

I was looking for my logon logs on the server they usually come from.

I tried searching from the host I loaded Test Words from, and it is the ONLY log that it has imported.

So back to me probably not running the command correctly?

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

I just tried the same command again and it appears to have worked. . . .

so, I don't know what the deal is / was but thank you all for your assistance!

[kyang]

Glad it's working now!

Also for December 5, when you did try to send the logs. Have you tried to query the logs for that day to see if they actually came through?

Did you have any more questions or are we okay to lock this up?