Detecting a string in a file

[Box293]

You have to compile it, follow the instructions in the check_log3 download.

[RIDS_I2MP]

Hi Team,

Kindly let me know how to implement it.

I am having check_log3.pl file and need to monitor a string in the log file of a windows host.

[rkennedy]

More details regarding it can be read on the plugin page here - http://exchange.nagios.org/directory/Pl ... pl/details

Another place to download the files is here - https://sourceforge.net/projects/pma-os ... s-plugins/

[lmiltchev]

Here's a working example:

I placed the Windows executable (check_log3.exe) in the NSClient++ scripts directory. I defined the "check_log3" command under the [/settings/external scripts/scripts] section in the nsclient.ini as such:

Code: Select all

check_log3 = scripts\check_log3.exe -l $ARG1$ -p $ARG2$

I placed a "test" log file in the C: directory ("C:\test.log") which contained bunch of lines similar to this one:

Code: Select all

[1459314000] CURRENT HOST STATE: Debian;UP;HARD;1;2, failed

Next, I tested it from Nagios XI CLI:

Code: Select all

/usr/local/nagios/libexec/check_nrpe -H x.x.x.x -c check_log3 -a "c:\test.log" "failed"
WARNING: Found 18 lines (limit=1/0): [1459314000] CURRENT HOST STATE: Debian;UP;HARD;1;2, failed|'lines'=18

Note: The second time you run the check, you will see:

Code: Select all

OK: Found 0 lines (limit=1/0): No matches found.|'lines'=0

If more lines, containing "failed" show up in the log file, the check would show you the number of the new lines (containing the pattern you are searching for).

Hope this helps.

[RIDS_I2MP]

Hi Team,

I have made the suggested configuration but I am receiving attached message:

Kindly suggest.

[RIDS_I2MP]

kindly also review the nsclient.log file.

[lmiltchev]

Make sure that you have the following two lines under BOTH sections in nsclient.ini - [/settings/NRPE/server] and [/settings/external scripts]

Code: Select all

allow arguments = 1
allow nasty characters = 1

Restart NSClient++ service, so that changes can take effect.

[RIDS_I2MP]

Hi Team,

I have made required changes now its not returning me any error message but it is not providing me required output.

It is not performing the check correctly, the string which I am passing in the command is present in the file but in output of command it says no matches, refer the snapshot attached.

[lmiltchev]

I have made required changes now its not returning me any error message but it is not providing me required output.

The results are cached, so if this is not a "new" entry, the check will not show any results. What happens if you add a few new lines to the "base.txt" file, containing "HOTFIX", and rerun the check? Does it find the new strings?

[RIDS_I2MP]

Hi Team,

Can we apply thresholds?