Another check_log Question

[stonkers]

So using check_log, we find "string a" and have it alert on this string. Then the next time it checks the log, it determines a recovery based on no more occurrences of the string. With WebSphere, the string "WSVR0605W" shows a thread is hung and the string "WSVR0606W" shows it has released the hung thread. Is there any way to configure check_log so that it looks for "WSVR0605W" for the error condition and "WSVR0606W" for the recovery condition? Thanks!

[tmcdonald]

You would most likely have to write a wrapper script that runs the plugin twice, looking first for the bad string then for the good string following it.

This sort of thing is why we wrote Nagios Log Server. You can build up queries that include multiple terms and see what happened in-between if needed.

[stonkers]

Gotcha! Saw log server and have been trying to push for it. Don't really know whether the powers that be are listening at all though... Thanks! You can lock this thread.