check_logfile

Checks logfiles or any other text format file for errors or other general patterns

In order to use this plugin, you need to enable CheckLogFile in the [/modules] section of the snclient_local.ini.

Also, to avoid security issues, you need to set allowed pattern in the [/settings/check/logfile] section of the snclient_local.ini to a comma separated list of allowed glob patterns.

Example:

[/settings/check/logfile]
allowed pattern  = /var/log/**      # This allows all files recursively in /var/log/
allowed pattern += /opt/logs/*.log  # This allows all files with .log extension in /opt/logs/

See here for details on the pattern syntax.

Implementation

Windows	Linux	FreeBSD	MacOSX
✅	✅	✅	✅

Argument Defaults

Argument	Default Value
empty-state	0 (OK)
empty-syntax	%(status) - No matching lines found
top-syntax	%(status) - %(problem_count)/%(count) line(s) found \n%(problem_list)
ok-syntax	%(status) - %(count) line(s) found
detail-syntax	%(line \| chomp \| cut=200)

Check Specific Arguments

Argument	Description
column-split	Tab split (default: \t)
file	The file pattern that should be checked
files	Comma separated list of file patterns
ignore-missing	Ignore the error if file pattern does not match any file
label	label:pattern => If the pattern is matched in a line the line will have the label set as detail
line-split	Character string used to split a file into several lines (default: \n)
max-lines	Maximum number of lines to read from each file (default: 10000)
offset	Starting position (in bytes) for scanning the file (0 for beginning). This overrides any saved offset

Attributes

Filter Keywords

these can be used in filters and thresholds (along with the default attributes):

Attribute	Description
count	Number of items matching the filter. Common option for all checks.
filename	The name of the file
line	Match the content of an entire line
columnN	Match the content of the N-th column only if enough columns exist

Examples

Default Check

Alert if there are errors in the SNClient log file:

check_logfile files=/var/log/snclient/snclient.log "warn=line like 'Warn'" "crit=line like 'Error'"
OK - 134 line(s) found

Non-OK output example check_logfile files=/var/log/snclient/snclient.log “warn=line like ‘Warn’” “crit=line like ‘Error’” CRITICAL - 23/548 line(s) found

Example using check_snclient and Naemon

Naemon Config

define command{
    command_name         check_snclient
    command_line         $USER1$/check_snclient -k -p 'your-password' -u 'https://$HOSTADDRESS$:8443' $ARG1$ $ARG2$
}

define service {
    host_name            testhost
    service_description  check_logfile
    use                  generic-service
    check_command        check_snclient!check_logfile!'files=/var/log/snclient/snclient.log' "warn=line like 'Warn'" "crit=line like 'Error'"
}