summaryrefslogtreecommitdiffstats
path: root/god/Monitoring/nagios/plugins/check_log
diff options
context:
space:
mode:
Diffstat (limited to 'god/Monitoring/nagios/plugins/check_log')
-rwxr-xr-xgod/Monitoring/nagios/plugins/check_log219
1 files changed, 219 insertions, 0 deletions
diff --git a/god/Monitoring/nagios/plugins/check_log b/god/Monitoring/nagios/plugins/check_log
new file mode 100755
index 00000000..4b60b5de
--- /dev/null
+++ b/god/Monitoring/nagios/plugins/check_log
@@ -0,0 +1,219 @@
+#! /bin/bash
+#
+# Log file pattern detector plugin for Nagios
+# Written by Ethan Galstad (nagios@nagios.org)
+# Last Modified: 07-31-1999
+#
+# Usage: ./check_log <log_file> <old_log_file> <pattern>
+#
+# Description:
+#
+# This plugin will scan a log file (specified by the <log_file> option)
+# for a specific pattern (specified by the <pattern> option). Successive
+# calls to the plugin script will only report *new* pattern matches in the
+# log file, since an copy of the log file from the previous run is saved
+# to <old_log_file>.
+#
+# Output:
+#
+# On the first run of the plugin, it will return an OK state with a message
+# of "Log check data initialized". On successive runs, it will return an OK
+# state if *no* pattern matches have been found in the *difference* between the
+# log file and the older copy of the log file. If the plugin detects any
+# pattern matches in the log diff, it will return a CRITICAL state and print
+# out a message is the following format: "(x) last_match", where "x" is the
+# total number of pattern matches found in the file and "last_match" is the
+# last entry in the log file which matches the pattern.
+#
+# Notes:
+#
+# If you use this plugin make sure to keep the following in mind:
+#
+# 1. The "max_attempts" value for the service should be 1, as this
+# will prevent Nagios from retrying the service check (the
+# next time the check is run it will not produce the same results).
+#
+# 2. The "notify_recovery" value for the service should be 0, so that
+# Nagios does not notify you of "recoveries" for the check. Since
+# pattern matches in the log file will only be reported once and not
+# the next time, there will always be "recoveries" for the service, even
+# though recoveries really don't apply to this type of check.
+#
+# 3. You *must* supply a different <old_file_log> for each service that
+# you define to use this plugin script - even if the different services
+# check the same <log_file> for pattern matches. This is necessary
+# because of the way the script operates.
+#
+# Examples:
+#
+# Check for login failures in the syslog...
+#
+# check_log /var/log/messages ./check_log.badlogins.old "LOGIN FAILURE"
+#
+# Check for port scan alerts generated by Psionic's PortSentry software...
+#
+# check_log /var/log/message ./check_log.portscan.old "attackalert"
+#
+
+# Paths to commands used in this script. These
+# may have to be modified to match your system setup.
+# TV: removed PATH restriction. Need to think more about what this means overall
+#PATH=""
+
+ECHO="/bin/echo"
+GREP="/bin/egrep"
+DIFF="/usr/bin/diff"
+TAIL="/usr/bin/tail"
+CAT="/bin/cat"
+RM="/bin/rm"
+CHMOD="/bin/chmod"
+TOUCH="/bin/touch"
+
+PROGNAME=`/usr/bin/basename $0`
+PROGPATH=`echo $0 | sed -e 's,[\\/][^\\/][^\\/]*$,,'`
+REVISION="1.4.15"
+
+. $PROGPATH/utils.sh
+
+print_usage() {
+ echo "Usage: $PROGNAME -F logfile -O oldlog -q query"
+ echo "Usage: $PROGNAME --help"
+ echo "Usage: $PROGNAME --version"
+}
+
+print_help() {
+ print_revision $PROGNAME $REVISION
+ echo ""
+ print_usage
+ echo ""
+ echo "Log file pattern detector plugin for Nagios"
+ echo ""
+ support
+}
+
+# Make sure the correct number of command line
+# arguments have been supplied
+
+if [ $# -lt 1 ]; then
+ print_usage
+ exit $STATE_UNKNOWN
+fi
+
+# Grab the command line arguments
+
+#logfile=$1
+#oldlog=$2
+#query=$3
+exitstatus=$STATE_WARNING #default
+while test -n "$1"; do
+ case "$1" in
+ --help)
+ print_help
+ exit $STATE_OK
+ ;;
+ -h)
+ print_help
+ exit $STATE_OK
+ ;;
+ --version)
+ print_revision $PROGNAME $REVISION
+ exit $STATE_OK
+ ;;
+ -V)
+ print_revision $PROGNAME $REVISION
+ exit $STATE_OK
+ ;;
+ --filename)
+ logfile=$2
+ shift
+ ;;
+ -F)
+ logfile=$2
+ shift
+ ;;
+ --oldlog)
+ oldlog=$2
+ shift
+ ;;
+ -O)
+ oldlog=$2
+ shift
+ ;;
+ --query)
+ query=$2
+ shift
+ ;;
+ -q)
+ query=$2
+ shift
+ ;;
+ -x)
+ exitstatus=$2
+ shift
+ ;;
+ --exitstatus)
+ exitstatus=$2
+ shift
+ ;;
+ *)
+ echo "Unknown argument: $1"
+ print_usage
+ exit $STATE_UNKNOWN
+ ;;
+ esac
+ shift
+done
+
+# If the source log file doesn't exist, exit
+
+if [ ! -e $logfile ]; then
+ $ECHO "Log check error: Log file $logfile does not exist!\n"
+ exit $STATE_UNKNOWN
+elif [ ! -r $logfile ] ; then
+ $ECHO "Log check error: Log file $logfile is not readable!\n"
+ exit $STATE_UNKNOWN
+fi
+
+# If the old log file doesn't exist, this must be the first time
+# we're running this test, so copy the original log file over to
+# the old diff file and exit
+
+if [ ! -e $oldlog ]; then
+ $CAT $logfile > $oldlog
+ $ECHO "Log check data initialized...\n"
+ exit $STATE_OK
+fi
+
+# The old log file exists, so compare it to the original log now
+
+# The temporary file that the script should use while
+# processing the log file.
+if [ -x /bin/mktemp ]; then
+ tempdiff=`/bin/mktemp /tmp/check_log.XXXXXXXXXX`
+else
+ tempdiff=`/bin/date '+%H%M%S'`
+ tempdiff="/tmp/check_log.${tempdiff}"
+ $TOUCH $tempdiff
+ $CHMOD 600 $tempdiff
+fi
+
+$DIFF $logfile $oldlog | $GREP -v "^>" > $tempdiff
+
+# Count the number of matching log entries we have
+count=`$GREP -c "$query" $tempdiff`
+
+# Get the last matching entry in the diff file
+lastentry=`$GREP "$query" $tempdiff | $TAIL -1`
+
+$RM -f $tempdiff
+$CAT $logfile > $oldlog
+
+if [ "$count" = "0" ]; then # no matches, exit with no error
+ $ECHO "Log check ok - 0 pattern matches found\n"
+ exitstatus=$STATE_OK
+else # Print total matche count and the last entry we found
+ $ECHO "($count) $lastentry"
+ exitstatus=$STATE_CRITICAL
+fi
+
+exit $exitstatus