contrib/check_log2.pl

   1 #!/usr/bin/perl -w
   2 #
   3 # $Id: check_log2.pl 1300 2005-12-16 18:41:45Z harpermann $
   4 #
   5 # Log file regular expression detector for Nagios.
   6 # Written by Aaron Bostick (abostick@mydoconline.com)
   7 # Last modified: 05-02-2002
   8 #
   9 # Thanks and acknowledgements to Ethan Galstad for Nagios and the check_log
  10 # plugin this is modeled after.
  11 #
  12 # Usage: check_log2 -l <log_file> -s <seek_file> -p <pattern> [-n <negpattern>]
  13 #
  14 # Description:
  15 #
  16 # This plugin will scan arbitrary text files looking for regular expression
  17 # matches.  The text file to scan is specified with <log_file>.
  18 # <log_seek_file> is a temporary file used to store the seek byte position
  19 # of the last scan.  This file will be created automatically on the first
  20 # scan.  <pattern> can be any RE pattern that perl's s/// syntax accepte.  Be
  21 # forewarned that a bad pattern will send this script into never never land!
  22 #
  23 # Output:
  24 #
  25 # This plugin returns OK when a file is successfully scanned and no pattern
  26 # matches are found.  WARNING is returned when 1 or more patterns are found
  27 # along with the pattern count and the line of the last pattern matched.
  28 # CRITICAL is returned when an error occurs, such as file not found, etc.
  29 #
  30 # Notes (paraphrased from check_log's notes):
  31 #
  32 #    1.  The "max_attempts" value for the service should be 1, as this
  33 #        will prevent Nagios from retrying the service check (the
  34 #        next time the check is run it will not produce the same results).
  35 #
  36 #    2.  The "notify_recovery" value for the service should be 0, so that
  37 #        Nagios does not notify you of "recoveries" for the check.  Since
  38 #        pattern matches in the log file will only be reported once and not
  39 #        the next time, there will always be "recoveries" for the service, even
  40 #        though recoveries really don't apply to this type of check.
  41 #
  42 #    3.  You *must* supply a different <log_Seek_file> for each service that
  43 #        you define to use this plugin script - even if the different services
  44 #        check the same <log_file> for pattern matches.  This is necessary
  45 #        because of the way the script operates.
  46 #
  47 # Examples:
  48 #
  49 # Check for error notices in messages
  50 #   check_log2 -l /var/log/messages -s ./check_log2.messages.seek -p 'err'
  51 #
  52
  53
  54 BEGIN {
  55     if ($0 =~ s/^(.*?)[\/\\]([^\/\\]+)$//) {
  56         $prog_dir = $1;
  57         $prog_name = $2;
  58     }
  59 }
  60
  61 require 5.004;
  62
  63 use lib $main::prog_dir;
  64 use utils qw($TIMEOUT %ERRORS &print_revision &support &usage);
  65 use Getopt::Long;
  66 my  ($dev,$ino,$mode,$nlink,$uid,$gid,$rdev,$size,$atime,$mtime,$ctime,$blksize,$blocks);
  67
  68 sub print_usage ();
  69 sub print_version ();
  70 sub print_help ();
  71
  72     # Initialize strings
  73     $log_file = '';
  74     $seek_file = '';
  75     $critical = '';
  76     $re_pattern = '';
  77     $neg_re_pattern = '';
  78     $pattern_count = 0;
  79     $pattern_line = '';
  80     $plugin_revision = '$Revision: 1300 $ ';
  81
  82     # Grab options from command line
  83     GetOptions
  84     ("l|logfile=s"      => \$log_file,
  85      "s|seekfile=s"     => \$seek_file,
  86      "c|critical"       => \$critical,
  87      "p|pattern=s"      => \$re_pattern,
  88      "n|negpattern:s"   => \$neg_re_pattern,
  89      "v|version"        => \$version,
  90      "h|help"           => \$help);
  91
  92     !($version) || print_version ();
  93     !($help) || print_help ();
  94
  95     # Make sure log file is specified
  96     ($log_file) || usage("Log file not specified.\n");
  97     # Make sure seek file is specified
  98     ($seek_file) || usage("Seek file not specified.\n");
  99     # Make sure re pattern is specified
 100     ($re_pattern) || usage("Regular expression not specified.\n");
 101
 102     # Open log file
 103     open (LOG_FILE, $log_file) || die "Unable to open log file $log_file: $!";
 104
 105     # Try to open log seek file.  If open fails, we seek from beginning of
 106     # file by default.
 107     if (open(SEEK_FILE, $seek_file)) {
 108         chomp(@seek_pos = <SEEK_FILE>);
 109         close(SEEK_FILE);
 110
 111         #  If file is empty, no need to seek...
 112         if ($seek_pos[0] != 0) {
 113
 114             # Compare seek position to actual file size.
 115                         # If file size is smaller
 116             # then we just start from beginning i.e. file was rotated, etc.
 117             ($dev,$ino,$mode,$nlink,$uid,$gid,$rdev,$size,$atime,$mtime,$ctime,$blksize,$blocks) = stat(LOG_FILE);
 118
 119             if ($seek_pos[0] <= $size) {
 120                 seek(LOG_FILE, $seek_pos[0], 0);
 121             }
 122         }
 123     }
 124
 125     # Loop through every line of log file and check for pattern matches.
 126     # Count the number of pattern matches and remember the full line of
 127     # the most recent match.
 128     while (<LOG_FILE>) {
 129         if ($neg_re_pattern) {
 130             if ((/$re_pattern/) && !(/$neg_re_pattern/)) {
 131                 $pattern_count += 1;
 132                 $pattern_line = $_;
 133             }
 134         } elsif (/$re_pattern/) {
 135                 $pattern_count += 1;
 136                 $pattern_line = $_;
 137         }
 138     }
 139
 140     # Overwrite log seek file and print the byte position we have seeked to.
 141     open(SEEK_FILE, "> $seek_file") || die "Unable to open seek count file $seek_file: $!";
 142     print SEEK_FILE tell(LOG_FILE);
 143
 144     # Close seek file.
 145     close(SEEK_FILE);
 146     # Close the log file.
 147     close(LOG_FILE);
 148
 149     # Print result and return exit code.
 150     if ($pattern_count) {
 151                 if ($critical) {
 152                         print "CRITICAL: ";
 153                 } else {
 154                         print "WARNING: ";
 155                 }
 156         print "($pattern_count): $pattern_line";
 157                 if ($critical) {
 158                         exit $ERRORS{'CRITICAL'};
 159                 } else {
 160                         exit $ERRORS{'WARNING'};
 161                 }
 162     } else {
 163         print "OK - No matches found.\n";
 164         exit $ERRORS{'OK'};
 165     }
 166
 167 #
 168 # Subroutines
 169 #
 170
 171 sub print_usage () {
 172     print "Usage: $prog_name -l <log_file> -s <log_seek_file> -p <pattern> [-n <negpattern>] -c | --critical\n";
 173     print "Usage: $prog_name [ -v | --version ]\n";
 174     print "Usage: $prog_name [ -h | --help ]\n";
 175 }
 176
 177 sub print_version () {
 178     print_revision($prog_name, $plugin_revision);
 179     exit $ERRORS{'OK'};
 180 }
 181
 182 sub print_help () {
 183     print_revision($prog_name, $plugin_revision);
 184     print "\n";
 185     print "Scan arbitrary log files for regular expression matches.\n";
 186     print "\n";
 187     print_usage();
 188     print "\n";
 189     print "-l, --logfile=<logfile>\n";
 190     print "    The log file to be scanned\n";
 191     print "-s, --seekfile=<seekfile>\n";
 192     print "    The temporary file to store the seek position of the last scan\n";
 193     print "-p, --pattern=<pattern>\n";
 194     print "    The regular expression to scan for in the log file\n";
 195     print "-n, --negpattern=<negpattern>\n";
 196     print "    The regular expression to skip in the log file\n";
 197     print "-c, --critical\n";
 198     print "    Return critical instead of warning on error\n";
 199     print "\n";
 200     support();
 201     exit $ERRORS{'OK'};
 202 }