Help with check_logfiles plugin command line options

[sambaba]

Need some help with the Nagios plugin check_logfiles. I'm making use of this plugin in order to monitor a system log file for one of my AIX server. I've installed and configured the Nagios ”check_logfiles" plugin successfully. But i'm facing an issue.

The command that i'm trying to run is

/opt/nagios/libexec #./check_logfiles -logfile=/tmp/test -criticalpattern="severity1" -okpattern="everything looks good" -warningpattern="warning_message added" -noprotocol

This is just an example. The file /tmp/test gets appended when application is up/down/not running. More like a syslog file.

For example, when the application crashes, the file /tmp/test gets appended something "severity1. Application is down" or when it comes

up successfully the file /tmp/test gets appended with something like "everything looks good".


So the command runs successfully only 1 time. The second time we run the command it doesn't show

any errors or warnings as in principle check_logfiles scans a log file until the end-of-file is reached. The offset will then be saved in a so-called seekfile. The next time check_logfiles runs, this offset will be used as the starting position inside the log file.


root@server1 /opt/nagios/libexec # cat /tmp/test
severity1 application is down
root@sdssutlt6798 /opt/nagios/libexec # ./check_logfiles -logfile=/tmp/test -criticalpattern="severity1" -okpattern="everything looks good" -warningpattern="warning_message added" -noprotocol
CRITICAL - (1 errors) - severity1 application is down |default_lines=1 default_warnings=0 default_criticals=1 default_unknowns=0

root@server1 /opt/nagios/libexec # ./check_logfiles -logfile=/tmp/test -criticalpattern="severity1" -okpattern="everything looks good" -warningpattern="warning_message added" -noprotocol
OK - no errors or warnings|default_lines=0 default_warnings=0 default_criticals=0 default_unknowns=0
root@server1 /opt/nagios/libexec #

In the above example, the command runs successfully and sends the alert as "CRITICAL" the first time

based upon the conditions we provided in the command line. But the next time the same command did not send any alert rather says "OK - no errors or warnings".

All I want is until the file /tmp/test gets updated with something "everything looks good" it should keep on showing the error as "critical with severity1"

I tried updating the command line option of "-okpattern" but still it isn't working as expected.

Is there any way we can remove the seek part and let the plugin reads the whole file and keep on generating the critical alert until the file /tmp/test gets updated. I tried every possible mean of deleting the seek file, applying some other options but still it isn't working.

Appreciate your response.

[eloyd]

Honestly, I've never like check_logfiles. I always write my own plugin to check logfiles the way I want to check them (using comm for instance, and just logging the changes usually makes things go faster).

[sambaba]

A similar issue was addressed in the previous post without a solution.

http://support.nagios.com/forum/viewtop ... 243#p63243

Any idea if we can get in touch with the owner of the plugin for a proper resolution.

[slansing]

Sure, you should be able to contact them through the information provided in the plugin's help output, or through their site listing:

http://exchange.nagios.org/directory/Pl ... es/details