Page 1 of 1
Importing Files?
Posted: Tue Dec 05, 2017 9:30 am
by joshua.tilson
I am looking for a simple way to Upload a single log file to Nagios Log Server.
I know there is a very detailed write up on how to do this with Linux, and netstat and python, and I'll be honest I don't do a lot of any of those, so to me it is overly complicated, and apparently I am not doing it right.
I have Dowloaded the Python script, I have uploaded the .log files onto the Nagios Log Server, this is the only Linux machine I manage and I have run the following command:
cat logons.log | python shipper.py | nc 192.168.80.221 2057
It sat for 5 minutes, then. . .nothing, no errors, no logs.
each line of the logfile is a new entry and looks like this:
logon: Mon 04/10/2017; 14:09:01.96; User; Server; Domain;
Can some one please help me decipher how to parse this file?
alternatively I was hoping for a little button on the Admin web interface that said "Upload Logfile". . .
Thanks!
Re: Importing Files?
Posted: Tue Dec 05, 2017 11:44 am
by cdienger
Does it just sit there for 5 minutes before bring you back to the command line? How large is the file? Any weird output if you just print the file to the screen with:
Code: Select all
cat logons.log | python shipper.py
or can you telnet to the ip/port ?
Also, make sure the port is up and listening on the NLS sever with:
There should also be an input configured in the web UI with the following settings:
Code: Select all
tcp {
type => 'import_json'
tags => 'import_json'
port => 2057
codec => json
}
Re: Importing Files?
Posted: Wed Dec 06, 2017 7:06 am
by joshua.tilson
My reply apparently got lost yesterday afternoon,
The file is only 7mb.
The CAT command returns lines like this one:
Code: Select all
{"message": "logon: Tue 12/05/2017 7:36:14.13; USER; SERVER; DOMAIN; \r\n"}
I cannot successfully telnet to the server on that port, I am however running this commands ON the server as it is the only linux machine I currently have access to.
and netstat returns the following
Code: Select all
tcp 0 0 :::2057 :::* LISTEN
tcp 0 0 ::ffff:192.168.80.221:2057 ::ffff:192.168.80.63:54767 ESTABLISHED
And i do have the input configured.
perhaps it is the location or way I formatted my command?
Re: Importing Files?
Posted: Wed Dec 06, 2017 10:24 am
by mcapra
joshua.tilson wrote:
alternatively I was hoping for a little button on the Admin web interface that said "Upload Logfile". . .
+1 for this as a feature.
Re: Importing Files?
Posted: Wed Dec 06, 2017 12:09 pm
by kyang
joshua.tilson,
joshua.tilson wrote:
alternatively I was hoping for a little button on the Admin web interface that said "Upload Logfile". . .
Did you want me to put that into a feature request?
Re: Importing Files?
Posted: Wed Dec 06, 2017 2:28 pm
by joshua.tilson
kyang wrote:
Also, did you want me to put that into a feature request?
I mean it seems like a good idea to me. I am sure others are struggling with this concept as well, I like to think I am technically competent, but nothing like a good old linux box to make you question your sanity!
Re: Importing Files?
Posted: Wed Dec 06, 2017 4:11 pm
by kyang
Sounds good!
Also, when you did try using the shipper.py command. Did anything show up in the
dashboards? Or nothing during the 5-minute wait?
Code: Select all
cat logons.log | python shipper.py | nc 192.168.80.221 2057
Are you able to send a string?
Code: Select all
echo 'test words' | nc 192.168.80.221 2057
Then go to your dashboard (if you got a lot of logs you could query for
test words) to see if it's there.
Re: Importing Files?
Posted: Thu Dec 07, 2017 7:12 am
by joshua.tilson
Some of this is my own lack of knowledge on how to properly use the product.
I tested the Test Words, and it showed up instantly! I realize that I was looking in the wrong place, Test words shows up under a new host 192.168.80.221 on the log server.
I was looking for my logon logs on the server they usually come from.
I tried searching from the host I loaded Test Words from, and it is the ONLY log that it has imported.
So back to me probably not running the command correctly?
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
I just tried the same command again and it appears to have worked. . . .
so, I don't know what the deal is / was but thank you all for your assistance!
Re: Importing Files?
Posted: Thu Dec 07, 2017 10:10 am
by kyang
Glad it's working now!
Also for December 5, when you did try to send the logs. Have you tried to query the logs for that day to see if they actually came through?
Did you have any more questions or are we okay to lock this up?