File And Folder Checks
File and Folder checks can help identify the following:
The sections below provide examples of how to perform these checks using different methods.
These checks are for how many files exist in a folder.
Nagios Plugins does not come bundled with a file count plugin however Nagios XI comes with the folder_watch.pl plugin (part of the Folder Watch configuration wizard).
In these examples the file pattern to check is a regular expression [^\0] which means "one or more non-null characters".
| Warning: | If more that 500 files are found |
| Critical: | If more that 1000 files are found |
Command:
./folder_watch.pl -f -T 'files' -D /usr/local/nagios/var/spool/perfdata/ -F '[^\0] +' -w 500 -c 1000
Output:
OK - 5 [^\0] files found | '[^\0] '=5;500;1000;;;
By default the plugin will only check files in that directory. If you wanted to recursively count the files in all sub folders you can use the -r argument.
Command:
./folder_watch.pl -r -f -T 'files' -D /usr/local/nagios/var/spool/ -F '[^\0] +' -w 500 -c 1000
Output:
OK - 51 [^\0] files found | '[^\0] '=51;500;1000;;;
NPCA does not include file or folder module.
NSClient++ vi check_nt does not include a file or folder module.
NSClient++ includes a check_files module.
| Warning: | If more that 500 files are found |
| Critical: | If more that 1000 files are found |
Command:
./check_nrpe -H 10.25.14.2 -c check_files -a path='C:\\Temp' pattern=*.* 'warning=count>500' 'critical=count>1000' top-syntax='${status}: ${count} files found' 'empty-state=ok'
Output:
OK: All 7 files are ok|'count'=7;500;1000
By default the check_files module will recursively count the files in all sub folders. You can use the max-depth argument to define how deep it should look.
Command:
./check_nrpe -H 10.25.14.2 -c check_files -a path='C:\\Temp' pattern=*.* 'warning=count>500' 'critical=count>1000' top-syntax='${status}: ${count} files found' 'empty-state=ok' max-depth=1
Output:
OK: All 6 files are ok|'count'=6;500;1000
Check WMI Plus includes a checkfoldersize module. The module does report how many files are found however it does not allow you to define thresholds on the amount of files found. Here is the command for your reference:
Command:
./check_wmi_plus.pl -H 10.25.14.3 -u wmiagent -p Str0ngP@ssw0rd -m checkfoldersize -a C:/Temp
Output:
OK - Folder C:/Temp/ is 33.194KB. Found 5 files(s). (List is on next line)|'C:/Temp/ Size'=33991bytes; 'File Count'=5;
You will need to download a third party plugin that provides this functionality, please check out the Nagios Exchange.
These checks are for the size of files.
Nagios Plugins comes with the check_file_age plugin which allows you to check the size of a file. However the plugin also checks the age of the file, so you need to define these thresholds as 0 if you only want to check the file size. The plugin thresholds are checking to make sure a file is at least a specific size.
| Critical: | At least 100MB in size (needs to be expressed as 100000000) |
Command:
./check_file_age -w 0 -c 0 -W 100000000 -C 100000000 -f /var/log/cron
Output:
FILE_AGE CRITICAL: /var/log/cron is 187 seconds old and 14418 bytes | age=187s;0;0 size=14418B;100000000;100000000;0
If you wanted to alert when the size was larger than a specific size then you could use the negate plugin to invert the returned result from the plugin (hence making CRITICAL an OK state).
| Critical: | No larger than 100MB in size (needs to be expressed as 100000000) |
Command:
./negate -s ./check_file_age -w 0 -c 0 -W 100000000 -C 100000000 -f /var/log/cron
Output:
FILE_AGE OK: /var/log/cron is 330 seconds old and 14418 bytes | age=330s;0;0 size=14418B;100000000;100000000;0
Alternatively Nagios XI comes bundled with a folder_watch.pl plugin (part of the Folder Watch configuration wizard).
In these examples the file pattern to check is a regular expression [^\0] which means "one or more non-null characters".
| Critical: | Larger than 100MB (100000000 bytes) |
Command:
./folder_watch.pl -f -T 'files' -D /var/log/ -F '[^\0] ' -s 100000000,100000000
Output:
OK - Largest size file is 14645064 bytes, 47 [^\0] files found | '[^\0] '=47 size_largest=14645064B;100000000 size_smallest=0B;;;;;
NPCA does not include file or folder module.
NSClient++ vi check_nt does not include a file or folder module.
NSClient++ includes a check_files module.
| Critical: | Larger than 100MB |
Command:
./check_nrpe -H 10.25.11.3 -c check_files -a path='E:\\ServerFolders\\NoBackup\\Junk' pattern=*.* 'filter=size gt 100M' 'warn= count > 0' 'crit= count > 0' top-syntax='${status}: ${count} files found ${problem_list}' 'empty-state=ok'
Output:
CRITICAL: 4 files found Setup.exe, IMG_3535.MOV, IMG_3540.MOV, backup.rar|'count'=4;0;0
Check WMI Plus includes a checkfilesize and checkfoldersize module.
checkfilesize
The checkfilesize lets you check the size of a specific file.
| Critical: | Larger than 100MB |
Command:
./check_wmi_plus.pl -H 10.25.14.3 -u wmiagent -p Str0ngP@ssw0rd -m checkfilesize -a C:/pagefile.sys -w 100m -c 100m
Output:
CRITICAL - [Triggered by FileSize>100m] - File C:/pagefile.sys is 1GB. Found 1 instance(s).|'C:/pagefile.sys Size'=1073741824bytes;104857600;104857600; 'File Count'=1;
checkfoldersize
The checkfoldersize lets you check the total size of a specific folder.
| Critical: | Larger than 100MB |
Command:
/check_wmi_plus.pl -H 10.25.14.3 -u wmiagent -p Str0ngP@ssw0rd -m checkfoldersize -a C:/Temp -w 100m -c 100m
Output:
OK - Folder C:/Temp/ is 33.194KB. Found 5 files(s). (List is on next line)|'C:/Temp/ Size'=33991bytes;104857600;104857600; 'File Count'=5;
You will need to download a third party plugin that provides this functionality, please check out the Nagios Exchange.
These checks are for making sure that a specific file or folder exists.
Nagios Plugins comes with the check_file_age plugin, this will return a critical state if the file does not exist.
Command:
./check_file_age -f /var/log/cron
Output:
FILE_AGE OK: /var/log/cron is 163 seconds old and 18974 bytes | age=163s;240;600 size=18974B;0;0;0
NPCA does not include file or folder module.
NSClient++ vi check_nt does not include a file or folder module.
NSClient++ includes a check_files module.
Command:
./check_nrpe -H 10.25.11.3 -c check_files -a path='C:\\pagefile.sys' 'warn= count < 1' 'crit= count < 1' top-syntax='${status}: ${count} files found ${problem_list}' 'empty-state=critical' show-all
Output:
OK: 1 files found pagefile.sys|'count'=1;1;1
Check WMI Plus includes a checkfilesize module, this will return a critical state if the file does not exist.
Command:
./check_wmi_plus.pl -H 10.25.14.3 -u wmiagent -p Str0ngP@ssw0rd -m checkfilesize -a C:/pagefile.sys
Output:
OK - File C:/pagefile.sys is 1GB. Found 1 instance(s).|'C:/pagefile.sys Size'=1073741824bytes; 'File Count'=1;
You will need to download a third party plugin that provides this functionality, please check out the Nagios Exchange.
These checks allow you to check when a file was last modified.
Nagios Plugins comes with the check_file_age plugin, the thresholds are checking to make sure a file is not older than an amount of seconds.
| Warning: | Not older than 300 seconds |
| Critical: | Not older than 600 seconds |
Command:
./check_file_age -w 300 -c 600 -f /var/log/cron
Output:
FILE_AGE CRITICAL: /var/log/cron is 1009 seconds old and 14418 bytes | age=1009s;300;600 size=14418B;0;0;0
NPCA does not include file or folder module.
NSClient++ vi check_nt does not include a file or folder module.
NSClient++ includes a check_files module. The module has many options and filters, here are some examples:
Make Sure Files Exists That Were Modified In The Last Two Hours
Check a folder to make sure files exist that were modified in the past two hours. Generate a critical alert if no files matching this criteria are found.
Command:
./check_nrpe -H 10.25.11.3 -c check_files -a path='E:\\ServerFolders\\NoBackup\\Junk' pattern=*.* 'filter= written > -2h' 'crit= count < 1' 'empty-state=critical' 'empty-syntax=${status}: No files found'
Output:
CRITICAL: No files found|'count'=0;0;1
Files Older Than
Check a folder to determine if any files exist that are older than two hours. Generate a critical alert if at least 1 file matches this criteria.
Command:
./check_nrpe -H 10.25.11.3 -c check_files -a path='E:\\ServerFolders\\NoBackup\\Junk' pattern=*.* 'filter= written < -2h' 'crit= count > 0' 'empty-state=ok' 'empty-syntax=${status}: No files found' 'top-syntax=${status}: ${count} files found'
Output:
CRITICAL: 6065 files found|'count'=6065;0;0
Check WMI Plus includes a checkfileage module, the following example checks a file to determine if it is older than the thresholds.
| Warning: | Older than 5 minutes |
| Critical: | Older than 10 minutes |
Command:
./check_wmi_plus.pl -H 10.25.14.3 -u wmiagent -p Str0ngP@ssw0rd -m checkfileage -a C:/Logs/server.log -w 5min -c 10min
Output:
CRITICAL - [Triggered by _FileAge>10min] - Age of File C:/Logs/server.log is 346 days 19:48:46 (499428min) or 8323.81hr(s).|'C:/Logs/server.log Age'=8323.81hr;0.0833333333333333;0.166666666666667;
You will need to download a third party plugin that provides this functionality, please check out the Nagios Exchange.
Here is an example where a check was required to make sure a folder was being created each day, the folder name was a "date based" directory like 27112017. The solution was to use the date command in backticks on the Nagios server which would generate the correct folder name. This solution demonstrates how you can tailor Nagios and the monitoring agents to your needs, all that is required is some creative thinking.
Credit goes to Nagios Forum users tmcdonald & warnox.
Command:
./check_nrpe -H 10.25.11.3 -c check_files -a path="C:\\Logs" "max-depth=2" "filter=filename='`date +%d%m%Y`'" "critical=count<1" "empty-state=CRITICAL" "empty-syntax=%(status): Cannot find folder `date +%d%m%Y`" "ok-syntax=%(status): Folder `date +%d%m%Y` found"
Output:
OK: Folder 27112017 found|'count'=1;0;1
NSClient++ has the path= and pattern= arguments for the check_files module.
When using path= and pattern= together, this will consume more overhead to execute as it looks at all the files in the folder. This is more noticeable when your folder has 10,000+ files.
If you only wanted to watch a specific file, ditch pattern= and put the whole filename in path=
path='D:\\Important Stuff\\Important File.txt'
HOWEVER if there is a chance that the file doesn't exist sometimes, then define the filename in the patttern=
path='D:\\Important Stuff' pattern='Important File.txt'
For any support related questions please visit the Nagios Support Forums at:
http://support.nagios.com/forum/
Article ID: 783
Created On: Sun, Nov 26, 2017 at 5:38 PM
Last Updated On: Thu, Feb 11, 2021 at 4:44 PM
Authored by: tlea
Online URL: https://support.nagios.com/kb/article/file-and-folder-checks-783.html