1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
|
#!/bin/sh
#
# Log file pattern detector plugin for monitoring
# Written originally by Ethan Galstad (nagios@nagios.org)
#
# Usage: ./check_log <log_file> <old_log_file> <pattern>
#
# Description:
#
# This plugin will scan a log file (specified by the <log_file> option)
# for a specific pattern (specified by the <pattern> option). Successive
# calls to the plugin script will only report *new* pattern matches in the
# log file, since an copy of the log file from the previous run is saved
# to <old_log_file>.
#
# Output:
#
# On the first run of the plugin, it will return an OK state with a message
# of "Log check data initialized". On successive runs, it will return an OK
# state if *no* pattern matches have been found in the *difference* between the
# log file and the older copy of the log file. If the plugin detects any
# pattern matches in the log diff, it will return a CRITICAL state and print
# out a message is the following format: "(x) last_match", where "x" is the
# total number of pattern matches found in the file and "last_match" is the
# last entry in the log file which matches the pattern.
#
# Notes:
#
# If you use this plugin make sure to keep the following in mind:
#
# 1. The "max_attempts" value for the service should be 1, as this will
# prevent the monitoring system from retrying the service check (the
# next time the check is run it will not produce the same results).
#
# 2. The "notify_recovery" value for the service should be 0, so that the
# monitoring system does not notify you of "recoveries" for the check.
# Since pattern matches in the log file will only be reported once and
# not the next time, there will always be "recoveries" for the service,
# even though recoveries really don't apply to this type of check.
#
# 3. You *must* supply a different <old_file_log> for each service that
# you define to use this plugin script - even if the different services
# check the same <log_file> for pattern matches. This is necessary
# because of the way the script operates.
#
# Examples:
#
# Check for login failures in the syslog...
#
# check_log /var/log/messages ./check_log.badlogins.old "LOGIN FAILURE"
#
# Check for port scan alerts generated by Psionic's PortSentry software...
#
# check_log /var/log/message ./check_log.portscan.old "attackalert"
#
# Paths to commands used in this script. These
# may have to be modified to match your system setup.
PATH="@TRUSTED_PATH@"
export PATH
PROGNAME=$(basename "$0")
PROGPATH=$(echo "$0" | sed -e 's,[\\/][^\\/][^\\/]*$,,')
REVISION="@NP_VERSION@"
. "$PROGPATH"/utils.sh
print_usage() {
echo "Usage: $PROGNAME -F logfile -O oldlog -q query"
echo "Usage: $PROGNAME --help"
echo "Usage: $PROGNAME --version"
}
print_help() {
print_revision "$PROGNAME" $REVISION
echo ""
print_usage
echo ""
echo "Log file pattern detector plugin for monitoring"
echo ""
support
}
# Make sure the correct number of command line
# arguments have been supplied
if [ $# -lt 1 ]; then
print_usage
exit "$STATE_UNKNOWN"
fi
# Grab the command line arguments
#logfile=$1
#oldlog=$2
#query=$3
exitstatus=$STATE_WARNING #default
while test -n "$1"; do
case "$1" in
--help)
print_help
exit "$STATE_OK"
;;
-h)
print_help
exit "$STATE_OK"
;;
--version)
print_revision "$PROGNAME" $REVISION
exit "$STATE_OK"
;;
-V)
print_revision "$PROGNAME" $REVISION
exit "$STATE_OK"
;;
--filename)
logfile=$2
shift
;;
-F)
logfile=$2
shift
;;
--oldlog)
oldlog=$2
shift
;;
-O)
oldlog=$2
shift
;;
--query)
query=$2
shift
;;
-q)
query=$2
shift
;;
-x)
exitstatus=$2
shift
;;
--exitstatus)
exitstatus=$2
shift
;;
*)
echo "Unknown argument: $1"
print_usage
exit "$STATE_UNKNOWN"
;;
esac
shift
done
# If the source log file doesn't exist, exit
if [ ! -e "$logfile" ]; then
echo "Log check error: Log file $logfile does not exist!"
exit "$STATE_UNKNOWN"
elif [ ! -r "$logfile" ] ; then
echo "Log check error: Log file $logfile is not readable!"
exit "$STATE_UNKNOWN"
fi
# If the old log file doesn't exist, this must be the first time
# we're running this test, so copy the original log file over to
# the old diff file and exit
if [ ! -e "$oldlog" ]; then
cat "$logfile" > "$oldlog"
echo "Log check data initialized..."
exit "$STATE_OK"
fi
# The old log file exists, so compare it to the original log now
# The temporary file that the script should use while
# processing the log file.
if [ -x /bin/mktemp ]; then
tempdiff=$(/bin/mktemp /tmp/check_log.XXXXXXXXXX)
else
tempdiff=$(/bin/date '+%H%M%S')
tempdiff="/tmp/check_log.${tempdiff}"
touch "$tempdiff"
chmod 600 "$tempdiff"
fi
diff "$logfile" "$oldlog" | grep -v "^>" > "$tempdiff"
# Count the number of matching log entries we have
count=$(grep -c "$query" "$tempdiff")
# Get the last matching entry in the diff file
lastentry=$(grep "$query" "$tempdiff" | tail -1)
rm -f "$tempdiff"
cat "$logfile" > "$oldlog"
if [ "$count" = "0" ]; then # no matches, exit with no error
echo "Log check ok - 0 pattern matches found"
exitstatus=$STATE_OK
else # Print total matche count and the last entry we found
echo "($count) $lastentry"
exitstatus=$STATE_CRITICAL
fi
exit "$exitstatus"
|
