check_log3 plugin not monitoring plain text file

[jyoti22]

I am working on log file monitoring using check_log3 plugin

When I try to monitor plain text file ORAERROR without any extension then I get below message which is incorrect

[root@dc1lpxxx ~]# /usr/local/nagios/libexec/check_nrpe -H dc2wsxxx -t 30 -c check_log3
OK: Found 0 lines (limit=1/1): No matches found.|'lines'=0
[root@dc1lp161990 ~]#

However when I change the same file to ORAERROR.txt I get correct output

[root@dc1lpxxx ~]# /usr/local/nagios/libexec/check_nrpe -H dc2wsxxx -t 30 -c check_log3
CRITICAL: Found 5 lines (limit=1/1): 2018-03-12 18:00:05.23 Backup Log was backed up. Database: ReportServer, creation date(time): 2010/11/24(09:51:48), first LSN: 909:32:1, last LSN: 909:32:1, number of dump devices: 1, device information: (FILE=1, TYPE=DISK: {'D:\MSSQL10.MSSQLSERVER\MSSQL\backup\ReportServer\ReportServer_backup_2018_03_12_180004_8751839.trn'}). This is an informational message only. No user action is required.|'lines'=5

Can someone please help me how can I monitor plain file without any extension. Thanks.

[mcapra]

Does the ORAERROR file reside on a Windows machine or a Linux machine? Are you using NRPE or NSClient++ as the agent on this remote machine? Which version of which agent are you using?

Which version of check_log3 are you using? I was unable to replicate this issue using the latest version executed locally against a CentOS 7 machine:

Code: Select all

[root@capra_nag tmp]# ./check_log3.pl --version
check_log3.pl version 3.15
[root@capra_nag tmp]# ./check_log3.pl -l /tmp/SOMEFILE -p 'some'
WARNING: Found 1 lines (limit=1/0): this is some file|lines=1
[root@capra_nag tmp]# ./check_log3.pl -l /tmp/SOMEFILE.txt -p 'another'
WARNING: Found 1 lines (limit=1/0): there is another file here with an extension|lines=1

Can you show us the NRPE/NSClient++ command definition that exists in your remote machine's NRPE/NSClient++ configuration for the check_log3 command?

Depending on whether or not this is a Linux or Windows machine, I'd also like to see the output of an ls -al or dir against the path in which ORAERROR resides.

[lmiltchev]

As mcapra said, we will need to see the "check_log3" command definition.

Having said that, I tested the following command, defined in the nsclient.ini file:

Code: Select all

check_log3_plain = scripts\check_log3.exe -l "c:\seek" -p "error"

which seemed to work just fine. The "seek" file doesn't have a ".txt" extension.

Here's my check, run from the command line on the Nagios XI machine, along with the output of it:

Code: Select all

[root@main-nagios-xi ~]# /usr/local/nagios/libexec/check_nrpe -H x.x.x.x -c check_log3_plain
WARNING: Found 3 lines (limit=1/0): This is an error.|'lines'=3

[jyoti22]

Hi,
ERRORLOG is on windows machine. I am using nsclient++ on it and to enable NRPE for the plugin i have added few lines in nsclient.ini file.

am added below entry in nsclient.ini file

; Undocumented key
NSClientServer = 1
NRPEServer = 1

[/settings/NRPE/server]

allow arguments = true

allow nasty characters=true
verify mode = none
insecure = true

port = 5666

use SSL = 1
[/settings/external scripts/scripts]
check_log3= scripts\check_log3.exe -l "C:\Program Files\Microsoft SQL Server\MSSQL10.MSSQLSERVER\MSSQL\Log\ERRORLOG" -p "Error" –t most_recent


From nagios serevr when i run the command i get below message

[nagios@dc1lp1xxx libexec]$ ./check_nrpe -H dc2wsxxxx -c check_log3
OK: Found 0 lines (limit=1/0): No matches found.|'lines'=0
[nagios@dc1lp1xxx libexec]$

Please help

[lmiltchev]

Do you have any recent entries in the ERRORLOG log, containing the "Error" pattern? Can you try adding a coupled of lines in the log manually, e.g.

Code: Select all

...
Error
Error

and rerun the check?

Code: Select all

/check_nrpe -H dc2wsxxxx -c check_log3

Did the output change?

[jyoti22]

the file "C:\Program Files\Microsoft SQL Server\MSSQL10.MSSQLSERVER\MSSQL\Log\ERRORLOG" is system generated and we cannot add manual entries in that.
I tried to copy lines from the file to other text file, there the plugin works file . But when i check same plugin for above mentioned file it do not work.

[tgriep]

The check_log3.exe creates a seek file the first time it runs a check against a log file.

-s, --seekfile=<seekfile|base_dir>
The temporary file to store the seek position of the last scan. If not
specified, it will be automatically generated.

So the first time the check runs, it will output the count of the pattern you are searching for.

Then the second time, it looks at the seek file for the position that is last searched in the file, checks for the patters and it is finds any new patterns, it will print out the count.

If there are no changes to the file, it will print out no matches found.

Can you check the ERRORLOG file to see if it is getting updated with new entries?

If not, then the check is working as designed.

[muadba]

Hi,

ERRORLOG is being updated with new logs.

Also we are not getting the initial result also.

However if I copy the same log into a testlog.txt file its working as expected. For each update in file its resulting the search output correctly.

Could you please advise on this ?

ERRORLOG is a normal windows file whose type is listing as "file". Once rotated its showing as "1.file"(for ERRORLOG.1).

[tgriep]

One thing to try.
Delete the seek file and run the test again to see if that is causing the issue and that you are getting the initial results.
The seek file typically is stores in the folder that the System Temp variable points to. "C:\Windows\TEMP"