3 # Log file pattern detector plugin for monitoring
4 # Written by Ethan Galstad (nagios@nagios.org)
5 # Last Modified: 07-31-1999
7 # Usage: ./check_log <log_file> <old_log_file> <pattern>
11 # This plugin will scan a log file (specified by the <log_file> option)
12 # for a specific pattern (specified by the <pattern> option). Successive
13 # calls to the plugin script will only report *new* pattern matches in the
14 # log file, since an copy of the log file from the previous run is saved
19 # On the first run of the plugin, it will return an OK state with a message
20 # of "Log check data initialized". On successive runs, it will return an OK
21 # state if *no* pattern matches have been found in the *difference* between the
22 # log file and the older copy of the log file. If the plugin detects any
23 # pattern matches in the log diff, it will return a CRITICAL state and print
24 # out a message is the following format: "(x) last_match", where "x" is the
25 # total number of pattern matches found in the file and "last_match" is the
26 # last entry in the log file which matches the pattern.
30 # If you use this plugin make sure to keep the following in mind:
32 # 1. The "max_attempts" value for the service should be 1, as this will
33 # prevent the monitoring system from retrying the service check (the
34 # next time the check is run it will not produce the same results).
36 # 2. The "notify_recovery" value for the service should be 0, so that the
37 # monitoring system does not notify you of "recoveries" for the check.
38 # Since pattern matches in the log file will only be reported once and
39 # not the next time, there will always be "recoveries" for the service,
40 # even though recoveries really don't apply to this type of check.
42 # 3. You *must* supply a different <old_file_log> for each service that
43 # you define to use this plugin script - even if the different services
44 # check the same <log_file> for pattern matches. This is necessary
45 # because of the way the script operates.
49 # Check for login failures in the syslog...
51 # check_log /var/log/messages ./check_log.badlogins.old "LOGIN FAILURE"
53 # Check for port scan alerts generated by Psionic's PortSentry software...
55 # check_log /var/log/message ./check_log.portscan.old "attackalert"
58 # Paths to commands used in this script. These
59 # may have to be modified to match your system setup.
61 PROGNAME
=`/bin/basename $0`
62 PROGPATH
=`echo $0 | sed -e 's,[\\/][^\\/][^\\/]*$,,'`
63 REVISION
="@NP_VERSION@"
71 echo "Usage: $PROGNAME -F logfile -O oldlog -q query"
72 echo "Usage: $PROGNAME --help"
73 echo "Usage: $PROGNAME --version"
77 print_revision
$PROGNAME $REVISION
81 echo "Log file pattern detector plugin for monitoring"
86 # Make sure the correct number of command line
87 # arguments have been supplied
94 # Grab the command line arguments
99 exitstatus
=$STATE_WARNING #default
100 while test -n "$1"; do
111 print_revision
$PROGNAME $REVISION
115 print_revision
$PROGNAME $REVISION
151 echo "Unknown argument: $1"
159 # If the source log file doesn't exist, exit
161 if [ ! -e $logfile ]; then
162 echo "Log check error: Log file $logfile does not exist!"
164 elif [ ! -r $logfile ] ; then
165 echo "Log check error: Log file $logfile is not readable!"
169 # If the old log file doesn't exist, this must be the first time
170 # we're running this test, so copy the original log file over to
171 # the old diff file and exit
173 if [ ! -e $oldlog ]; then
174 cat $logfile > $oldlog
175 echo "Log check data initialized..."
179 # The old log file exists, so compare it to the original log now
181 # The temporary file that the script should use while
182 # processing the log file.
183 if [ -x /bin
/mktemp
]; then
184 tempdiff
=`/bin/mktemp /tmp/check_log.XXXXXXXXXX`
186 tempdiff
=`/bin/date '+%H%M%S'`
187 tempdiff
="/tmp/check_log.${tempdiff}"
192 diff $logfile $oldlog |
grep -v "^>" > $tempdiff
194 # Count the number of matching log entries we have
195 count
=`grep -c "$query" $tempdiff`
197 # Get the last matching entry in the diff file
198 lastentry
=`grep "$query" $tempdiff | tail -1`
201 cat $logfile > $oldlog
203 if [ "$count" = "0" ]; then # no matches, exit with no error
204 echo "Log check ok - 0 pattern matches found"
206 else # Print total matche count and the last entry we found
207 echo "($count) $lastentry"
208 exitstatus
=$STATE_CRITICAL