Page 1 of 1

log2ndo utility errors after converting julian to date

Posted: Tue Jun 05, 2012 1:28 pm
by rnygren
I have converted 2 years of log files from julian to date with the following shell script
#!/bin/bash
FILES=/usr/local/nagios/var/archives/*.log
for f in $FILES
do
#echo "$f"
if [ "$f" = "/usr/local/nagios/var/archives/*.log" ]; then
break;
fi
cat $f | while read date rest ; do timestamp=$(echo $date | sed 's/\[//;s/\]//'); echo $(date -d @$timestamp) $rest ; done > $f"T" ; rm $f
done

So How can I load this data into mysql using log to ndo? It seems to error out on the converted date as it probably expects a julian.
is there a argument switch. Looking for events with julian was impossible so I fond this script to convert to real date time.
format is :

Tue Oct 25 00:00:00 PDT 2011 CURRENT HOST STATE: affinity_node_a;UP;HARD;1;PING OK - Packet loss = 0%, RTA = 0.34 ms

or as a worst case is there a sed command to reverse as I did not keep original logs (Whoops)

Re: log2ndo utility errors after converting julian to date

Posted: Wed Jun 06, 2012 10:58 am
by agriffin
This command should get your log files into a state where they can be imported into ndoutils (it doesn't delete your old files, and the new ones will have ".fixed" appended to their filename):

Code: Select all

for file in /usr/local/nagios/var/archives/*.log; do
    awk '{"date -d \"" $1 " " $2 " " $3 " " $4 " " $5 " " $6 "\" +[%s]" | getline date; printf(date); for (i=7; i<=NF; i++) printf(" %s", $i); printf("\n")}' <"$file" >"$file.fixed"
done

Re: log2ndo utility errors after converting julian to date

Posted: Wed Jun 06, 2012 5:05 pm
by rnygren
If you look at my shell script it deletes the original log files so I only have the ones with the corrected date time stamp instead of the julian date number in the 1st column. Since I have 2 yrs history it wuold be nive to revert back to the original log file format so log2ndo would work

Re: log2ndo utility errors after converting julian to date

Posted: Wed Jun 06, 2012 5:07 pm
by rnygren
Sorry I didnt notice the additional code and misread the test.
Thanks I will try this when I get the ndoutil working again right now I am recovering from a rebuils as opsview broke everying