How to monitor logs

[Frédéric GRANAT]

Hi,
According to you what is the best way to monitor logs using nagiosXI ?

Rgds,

Frederic

[mcapra]

Shameless plug for Nagios Log Server. It's much more performant when working with more than a few dozen log files.

check_logfiles exists, gets regular updates, and is reasonably easy to use:
https://labs.consol.de/nagios/check_logfiles/index.html

check_log3.pl is another one I've had success with:
https://exchange.nagios.org/directory/P ... pl/details

[Frédéric GRANAT]

Is Nagios log server usage included in my license ?

[lmiltchev]

I don't believe it is - just checked our system. However, I could be wrong. This is more of a sales question. Please contact our sales team at [email protected]. They will be able to help you out. Thanks!

[Frédéric GRANAT]

Thanks,
About check_logfiles : I've got 92 Windows servers to monitor, do you think the plugin will do the job ?

[lmiltchev]

This is a 3rd party plugin. Unfortunately, we cannot guarantee that it will work. I glanced through the README.windows-exe file, and what I saw didn't give me much confidence...

If it does not work it's not my fault. It worked for me and my PC.
I read the documentation and played around until it worked.
If it does not work for you, read the documentation and play around.
At least for a week.
If it still does not work, forget check_logfiles.
Use check_hanswurscht instead...

I would recommend that you try it on one Windows box before deciding if it is worth proceeding with it.

[Frédéric GRANAT]

Hi,
Below what I can read about installing check_logfiles :

"Installation

After unpacking the tar-archive you have to call ./configure. With ./configure –help you can show the options if you want to modify the default settings. However, these settings can later be overridden again by variables in the config file."

I don't understand anything to that. Isn't it possible to install that plugin through the GUI ?
Does that plugin requires nsclient++ on windows hosts ?

[lmiltchev]

These are instructions for Linux. There is a bullet points for Windows:

- Under Windows you build the plugin with perl winconfig.pl. This will result in plugins-scripts/check_logfiles.
- The file README.exe contains instructions how to build a Windows ninary check_logfiles.exe.

and there is a README.windows-exe file in the check_logfiles-3.9 directory:

How to create a windows native binary
check_logfiles.exe

0) Deinstall ActiveState Perl VMWare Remote CLI
and any other Perl packages you can find.

1) Install Strawberry Perl
from http://strawberryperl.com/

2) Prepare your environment so that strawberry perl
is the preferred perl interpreter.
$env:STRAWDIR = "C:\Users\lausser\Documents\Software\strawberry-perl-5.26.2.1-64bit-portable"
$env:Path = $env:STRAWDIR + '\perl\bin;' + $env:Path
$env:Path = $env:STRAWDIR + '\perl\site\bin;' + $env:Path
$env:Path = $env:STRAWDIR + '\c\bin;' + $env:Path
$env:Path = $env:STRAWDIR + '\perl\site\bin;' + $env:Path
Better: Deinstall ActiveState Perl and any other Perl packages you can find.

3) Install PAR::Packer
perl -MCPAN -eshell
install PAR
install PAR::Packer
You will see error messages and the installation will fail.
No problem! We can repair it.
cd C:\strawberry\cpan\build
a)
cd PAR-0.980-<a lot of crap>
perl Makefile.PL
dmake
dmake install
b)
cd PAR-Packer-0.980-<a lot of crap>
edit myldr/Makefile.PL and add
$file =~ s/^lib// if $^O eq "MSWin32";
after line 142.
perl Makefile.PL
dmake
dmake install

4) Build the plugin
cd check_logfiles-x.x.x.x
perl winconfig.pl

5) Compile the plugin
cd plugins-scripts
pp -M PerlIO -M Digest::MD5 -M Encode::Encoding -M Encode::Unicode -M Encode::Unicode::UTF7 -M Net::Domain -M Win32::NetResource -M Win32::Daemon -M Time::Piece -M Time::Local -M Win32::EventLog -M Win32::TieRegistry -M Win32::WinError -M Date::Manip -M Win32::OLE -o check_logfiles.exe check_logfiles
(maybe you need to install Win32::NetResource and Win32::Daemon)
(Win32::Service is useful, too)

6) Package the plugin
C:\Programme\WinZip\WINZIP32.EXE -a check_logfiles.zip plugins-scripts\check_logfiles

If it does not work it's not my fault. It worked for me and my PC.
I read the documentation and played around until it worked.
If it does not work for you, read the documentation and play around.
At least for a week.
If it still does not work, forget check_logfiles.
Use check_hanswurscht instead. The source of check_hanswurscht is:

printf "hello hanswurscht\n";

Now try to create a windows binary with
pp -o check_hanswurscht.exe check_hanswurscht

Do not contact me if check_hanswurscht.exe doesn't work.
Please contact Strawberry and tell them:
"hi, i am a hanswurscht and i have a problem..."

The plugin could be used with NSClient++ and NRPE or NCPA. I found a VERY OLD post on the usage with NSClient++ here:
http://nagios.fm4dd.com/howto/monitor-c ... gfiles.htm

This will give you an idea of how the plugin could be used on Windows.

The bad news is that the installation of the plugin on the Windows machine is somewhat involved - you would need to install strawberry perl, build and compile the plugin on Windows, etc. ...and you would need to do this on all 92 machines if you decide to go this route... We may not be able to help you if you get stuck on something as this is not one of our plugins, and we are not familiar with it. In my opinion, you will be better off using Nagios Log Server, but this is a choice you will need to make. Thank you!

[Frédéric GRANAT]

Hi,
Thanks for your advices : installing something on each servers is exactly what I don't want.
I'm going to assess the log server solution.

[lmiltchev]

Sure, let us know if you have any further questions.