plugins-scripts/check_log.sh

   1 #!/bin/sh
   2 #
   3 # Log file pattern detector plugin for monitoring
   4 # Written by Ethan Galstad (nagios@nagios.org)
   5 # Last Modified: 07-31-1999
   6 #
   7 # Usage: ./check_log <log_file> <old_log_file> <pattern>
   8 #
   9 # Description:
  10 #
  11 # This plugin will scan a log file (specified by the <log_file> option)
  12 # for a specific pattern (specified by the <pattern> option).  Successive
  13 # calls to the plugin script will only report *new* pattern matches in the
  14 # log file, since an copy of the log file from the previous run is saved
  15 # to <old_log_file>.
  16 #
  17 # Output:
  18 #
  19 # On the first run of the plugin, it will return an OK state with a message
  20 # of "Log check data initialized".  On successive runs, it will return an OK
  21 # state if *no* pattern matches have been found in the *difference* between the
  22 # log file and the older copy of the log file.  If the plugin detects any
  23 # pattern matches in the log diff, it will return a CRITICAL state and print
  24 # out a message is the following format: "(x) last_match", where "x" is the
  25 # total number of pattern matches found in the file and "last_match" is the
  26 # last entry in the log file which matches the pattern.
  27 #
  28 # Notes:
  29 #
  30 # If you use this plugin make sure to keep the following in mind:
  31 #
  32 #    1.  The "max_attempts" value for the service should be 1, as this will
  33 #        prevent the monitoring system from retrying the service check (the
  34 #        next time the check is run it will not produce the same results).
  35 #
  36 #    2.  The "notify_recovery" value for the service should be 0, so that the
  37 #        monitoring system does not notify you of "recoveries" for the check.
  38 #        Since pattern matches in the log file will only be reported once and
  39 #        not the next time, there will always be "recoveries" for the service,
  40 #        even though recoveries really don't apply to this type of check.
  41 #
  42 #    3.  You *must* supply a different <old_file_log> for each service that
  43 #        you define to use this plugin script - even if the different services
  44 #        check the same <log_file> for pattern matches.  This is necessary
  45 #        because of the way the script operates.
  46 #
  47 # Examples:
  48 #
  49 # Check for login failures in the syslog...
  50 #
  51 #   check_log /var/log/messages ./check_log.badlogins.old "LOGIN FAILURE"
  52 #
  53 # Check for port scan alerts generated by Psionic's PortSentry software...
  54 #
  55 #   check_log /var/log/message ./check_log.portscan.old "attackalert"
  56 #
  57
  58 # Paths to commands used in this script.  These
  59 # may have to be modified to match your system setup.
  60
  61 PATH="@TRUSTED_PATH@"
  62 export PATH
  63 PROGNAME=`basename $0`
  64 PROGPATH=`echo $0 | sed -e 's,[\\/][^\\/][^\\/]*$,,'`
  65 REVISION="@NP_VERSION@"
  66
  67 . $PROGPATH/utils.sh
  68
  69 print_usage() {
  70     echo "Usage: $PROGNAME -F logfile -O oldlog -q query"
  71     echo "Usage: $PROGNAME --help"
  72     echo "Usage: $PROGNAME --version"
  73 }
  74
  75 print_help() {
  76     print_revision $PROGNAME $REVISION
  77     echo ""
  78     print_usage
  79     echo ""
  80     echo "Log file pattern detector plugin for monitoring"
  81     echo ""
  82     support
  83 }
  84
  85 # Make sure the correct number of command line
  86 # arguments have been supplied
  87
  88 if [ $# -lt 1 ]; then
  89     print_usage
  90     exit $STATE_UNKNOWN
  91 fi
  92
  93 # Grab the command line arguments
  94
  95 #logfile=$1
  96 #oldlog=$2
  97 #query=$3
  98 exitstatus=$STATE_WARNING #default
  99 while test -n "$1"; do
 100     case "$1" in
 101         --help)
 102             print_help
 103             exit $STATE_OK
 104             ;;
 105         -h)
 106             print_help
 107             exit $STATE_OK
 108             ;;
 109         --version)
 110             print_revision $PROGNAME $REVISION
 111             exit $STATE_OK
 112             ;;
 113         -V)
 114             print_revision $PROGNAME $REVISION
 115             exit $STATE_OK
 116             ;;
 117         --filename)
 118             logfile=$2
 119             shift
 120             ;;
 121         -F)
 122             logfile=$2
 123             shift
 124             ;;
 125         --oldlog)
 126             oldlog=$2
 127             shift
 128             ;;
 129         -O)
 130             oldlog=$2
 131             shift
 132             ;;
 133         --query)
 134             query=$2
 135             shift
 136             ;;
 137         -q)
 138             query=$2
 139             shift
 140             ;;
 141         -x)
 142             exitstatus=$2
 143             shift
 144             ;;
 145         --exitstatus)
 146             exitstatus=$2
 147             shift
 148             ;;
 149         *)
 150             echo "Unknown argument: $1"
 151             print_usage
 152             exit $STATE_UNKNOWN
 153             ;;
 154     esac
 155     shift
 156 done
 157
 158 # If the source log file doesn't exist, exit
 159
 160 if [ ! -e $logfile ]; then
 161     echo "Log check error: Log file $logfile does not exist!"
 162     exit $STATE_UNKNOWN
 163 elif [ ! -r $logfile ] ; then
 164     echo "Log check error: Log file $logfile is not readable!"
 165     exit $STATE_UNKNOWN
 166 fi
 167
 168 # If the old log file doesn't exist, this must be the first time
 169 # we're running this test, so copy the original log file over to
 170 # the old diff file and exit
 171
 172 if [ ! -e $oldlog ]; then
 173     cat $logfile > $oldlog
 174     echo "Log check data initialized..."
 175     exit $STATE_OK
 176 fi
 177
 178 # The old log file exists, so compare it to the original log now
 179
 180 # The temporary file that the script should use while
 181 # processing the log file.
 182 if [ -x /bin/mktemp ]; then
 183     tempdiff=`/bin/mktemp /tmp/check_log.XXXXXXXXXX`
 184 else
 185     tempdiff=`/bin/date '+%H%M%S'`
 186     tempdiff="/tmp/check_log.${tempdiff}"
 187     touch $tempdiff
 188     chmod 600 $tempdiff
 189 fi
 190
 191 diff $logfile $oldlog | grep -v "^>" > $tempdiff
 192
 193 # Count the number of matching log entries we have
 194 count=`grep -c "$query" $tempdiff`
 195
 196 # Get the last matching entry in the diff file
 197 lastentry=`grep "$query" $tempdiff | tail -1`
 198
 199 rm -f $tempdiff
 200 cat $logfile > $oldlog
 201
 202 if [ "$count" = "0" ]; then # no matches, exit with no error
 203     echo "Log check ok - 0 pattern matches found"
 204     exitstatus=$STATE_OK
 205 else # Print total matche count and the last entry we found
 206     echo "($count) $lastentry"
 207     exitstatus=$STATE_CRITICAL
 208 fi
 209
 210 exit $exitstatus