Log file monitoring on Unix

[vishal313]

Hi,

We have Nagios XI 5.6.10. We are monitoring log files on Unix system for content match.
We have got a requirement to monitor a log file for a specific numerical value. If the value found in the file is above the threshold number, then an alert should be triggered.
Could you please suggest which plugin can help us in monitoring a value inside the log file.


Regards
Vishal Dhote

[benjaminsmith]

Hi Vishal Dhote,

What plugin are your currently using to monitor log files. In this particular case, you'll need a plugin that allows you to use Regex patterns on the log file contents and setup check results based on those. Take a look at the Nagios Exchange for options here.

https://exchange.nagios.org/directory/Plugins/Log-Files

Can you share the example patterns of what you would like to notify on in the log files? Thanks, Benjamin

[vishal313]

Hi Benjamin,

Thank you for your reply. We are using check_log3.pl plugin on our Unix systems.
The requirement:
We will run a script to execute the below command and post this output to a file every 5 mins. I have provided the sample file below.

swadminS:/apps/ipe/eipsit2/util$ swadm COUNT_MESSAGES ALL > /tmp/Count_Msgs_EIP.txt
swadminS:/apps/ipe/eipsit2/util$
swadminS:/apps/ipe/eipsit2/util$ cat /tmp/Count_Msgs_EIP.txt
The total count of the messages in the queue 1: 0
The total count of the messages in the queue 2: 0
The total count of the messages in the queue 3: 0
The total count of the messages in the queue 4: 0
The total count of the messages in the queue 5: 0
The total count of the messages in the queue 6: 0

And this file should be continuously monitored and if queue count is more than 100, it should trigger alert
Please help.

Regards
Vishal Dhote

[benjaminsmith]

HI Vishal,

I tested the following regex pattern on the sample log you provided with that plugin and it's matching up anything over 100. The -d option will force the plugin to return critical if the log file has not been written to since the last check.

Code: Select all

./check_log3.pl -l sample-log.txt -s seek.txt -p 'queue\s+\d+:\s+0*[1-9]\d{2,}' --critical=1 -d

Let me know if that works for you.

Benjamin