Plugin to parse a log file?

[rpacheco]

I'm looking for some help.

I've been using check_logfiles plugin to check a logfile that collects syslog events. But it is not exactly what I've been asked for, and after looking for it, I found nothing.

The file that collects the syslog events is supposed to receive only errors, so I would like to parse some particular info from every line and show all these lines in a cool way. Is there any plugin or addOn that allows to show, for example, a table with all these lines parsing some selected info?

Thanks in advance.

[mguthrie]

Are you looking to do this on windows or linux?

[rpacheco]

I've installed the Nagios demo (so it is Centos OS) and the syslog server is a Windows machine where I've installed de Nagios Client ++

[yancy]

rpacheco,

What Windows application are you using to act as a syslog server?


Regards,

-Yancy

[rpacheco]

Right now I'm using kiwisyslog

[yancy]

rpacheco,

Can you be more specific about what data you want check_logsfiles to submit back to Nagios?

As a side note, it looks like Kiwi Syslog could also be integrated with Nagios using SNMP traps.


Regards,

-Yancy

[rpacheco]

Thanks yancy.

Every line of my logfile should be an alert. What I really would like is to show a table with this information, so I would like to know if I can handle it and parse the different fields (separated by '#' in plain text in each line) or if I have to define a different service for each possible line in the logfile. So I don't really know if check_logfiles is the best plugin for me or not, or how can I handle it to integrate with Nagios.

Thanks in advance!

[yancy]

rpacheco,

What I really would like is to show a table with this information

Is your goal to show this "table" of information in Nagios?

Regards,

-Yancy

[jronin]

Yancy:

I have also looked at check_logfiles and was looking for a way to pass syslog data to a table in nagios. Any ideas?

[slansing]

rpacheco,

It looks like you asked this over at Spiceworks too but I'm afraid the answer will be the same, there is no way to really do this currently short of creating your own component.