Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I have configured Nagios monitoring tool for a linux server m/c to monitor another linux host m/c(till now I am monitoring a single m/c only). I have followed the official documentation and installed nagios server on server side and NRPE daemon on client side. As per documentation the nagios is working successfully and maintaining its periodic checks for all the services that I have made it to monitor and also installed some additional plugins too.

But I want to know the procedure how to get output of the monitoring hostory in a particular file in a proper format. As I have not installed the web interface through Apache, yet is there any solution for my problem

Following is the log file I am getting for nagios monitoring:

[1349064000] LOG ROTATION: DAILY
[1349064000] LOG VERSION: 2.0
[1349064000] CURRENT HOST STATE: localhost;UP;HARD;1;PING OK - Packet loss = 0%, RTA = 0.03 ms
[1349064000] CURRENT HOST STATE: remotehost;UP;HARD;1;PING OK - Packet loss = 0%, RTA = 0.17 ms
[1349064000] CURRENT SERVICE STATE: localhost;Current Load;OK;HARD;1;OK - load average: 0.00, 0.00, 0.00
[1349064000] CURRENT SERVICE STATE: localhost;Current Users;OK;HARD;1;USERS OK - 7 users currently logged in
[1349064000] CURRENT SERVICE STATE: localhost;HTTP;OK;HARD;1;HTTP OK HTTP/1.1 200 OK - 1889 bytes in 0.001 seconds
[1349064000] CURRENT SERVICE STATE: localhost;PING;OK;HARD;1;PING OK - Packet loss = 0%, RTA = 0.04 ms
[1349064000] CURRENT SERVICE STATE: localhost;Root Partition;CRITICAL;HARD;100;DISK CRITICAL - free space: / 108 MB (1% inode=61%):
[1349064000] CURRENT SERVICE STATE: localhost;SSH;OK;HARD;1;SSH OK - OpenSSH_5.1 (protocol 2.0)
[1349064000] CURRENT SERVICE STATE: localhost;Swap Usage;OK;HARD;1;SWAP OK - 97% free (841 MB out of 870 MB)
[1349064000] CURRENT SERVICE STATE: localhost;Total Processes;OK;HARD;1;PROCS OK: 79 processes with STATE = RSZDT
[1349064000] CURRENT SERVICE STATE: remotehost;CPU Load;OK;HARD;1;OK - load average: 0.08, 0.02, 0.01
[1349064000] CURRENT SERVICE STATE: remotehost;Current Users;WARNING;HARD;3;USERS WARNING - 3 users currently logged in
[1349064000] CURRENT SERVICE STATE: remotehost;File Size;WARNING;HARD;3;WARN: /home/new/ctags.1p has size 13864 Byte. Warn at 13000. :
[1349064000] CURRENT SERVICE STATE: remotehost;Swap Usage;OK;HARD;1;SWAP OK - 100% free (869 MB out of 870 MB)
[1349064000] CURRENT SERVICE STATE: remotehost;Total Processes;OK;HARD;1;PROCS OK: 106 processes
[1349064000] CURRENT SERVICE STATE: remotehost;Zombie Processes;OK;HARD;1;PROCS OK: 0 processes with STATE = Z
[1349064028] SERVICE NOTIFICATION: nagiosadmin;remotehost;Current Users;WARNING;notify-service-by-email;USERS WARNING - 3 users currently logged in
[1349064988] Auto-save of retention data completed successfully.
[1349065258] SERVICE NOTIFICATION: nagiosadmin;remotehost;File Size;WARNING;notify-service-by-email;WARN: /home/new/ctags.1p has size 13864 Byte. Warn at 13000. :
[1349065938] SERVICE NOTIFICATION: nagiosadmin;localhost;Root Partition;CRITICAL;notify-service-by-email;DISK CRITICAL - free space: / 109 MB (1% inode=61%):
[1349067628] SERVICE NOTIFICATION: nagiosadmin;remotehost;Current Users;WARNING;notify-service-by-email;USERS WARNING - 3 users currently logged in
[1349068588] Auto-save of retention data completed successfully.
[1349068858] SERVICE NOTIFICATION: nagiosadmin;remotehost;File Size;WARNING;notify-service-by-email;WARN: /home/new/ctags.1p has size 13864 Byte. Warn at 13000. :
[1349069538] SERVICE NOTIFICATION: nagiosadmin;localhost;Root Partition;CRITICAL;notify-service-by-email;DISK CRITICAL - free space: / 109 MB (1% inode=61%)

Tell me please if I am wrong at something regarding this. If any more nagios info is required for this problem, let me know I will share that surely.

Thanks in advance.

share|improve this question
1  
What i gather from here, is that you are getting all the info on the console. However, you want them to be printed in a text file with a proper format. Is my understanding correct? If so, kindly tell us, how do you run this one ? Do you feed any command to the terminal or you just start and stop the service like WAS ? –  The Dark Knight Oct 1 '12 at 11:56
    
yes I am getting all this from a log file generated in the nagios folder. Yes you are right that I want the output in a file so that it shows atleast the time when nagios is fetching the output from the services of monitored m/c. Nagios is made to start-up during system boot and its service can just be started using 'service start' and 'service stop'. –  Manroop Oct 3 '12 at 8:35
add comment

1 Answer

First let me tell you that i am extremely sorry for not answering your question as i was a little busy these last few days.

Here I am going to provide you two answers to your question .

First Answer :(Flat and non innovative):

                        !/bin/sh
                        #
                        # Log file pattern detector plugin for Nagios
                        #
                        # Usage: ./check_log <log_file> <old_log_file> <pattern>
                        #
                        # Description:
                        #
                        # This plugin will scan a log file (specified by the <log_file> option)
                        # for a specific pattern (specified by the <pattern> option).  Successive
                        # calls to the plugin script will only report *new* pattern matches in the
                        # log file, since an copy of the log file from the previous run is saved
                        # to <old_log_file>.
                        #
                        # Output:
                        #
                        # On the first run of the plugin, it will return an OK state with a message
                        # of "Log check data initialized".  On successive runs, it will return an OK
                        # state if *no* pattern matches have been found in the *difference* between the
                        # log file and the older copy of the log file.  If the plugin detects any 
                        # pattern matches in the log diff, it will return a CRITICAL state and print
                        # out a message is the following format: "(x) last_match", where "x" is the
                        # total number of pattern matches found in the file and "last_match" is the
                        # last entry in the log file which matches the pattern.
                        #
                        # Notes:
                        #
                        # If you use this plugin make sure to keep the following in mind:
                        #
                        #    1.  The "max_attempts" value for the service should be 1, as this
                        #        will prevent Nagios from retrying the service check (the
                        #        next time the check is run it will not produce the same results).
                        #
                        #    2.  The "notify_recovery" value for the service should be 0, so that
                        #        Nagios does not notify you of "recoveries" for the check.  Since
                        #        pattern matches in the log file will only be reported once and not
                        #        the next time, there will always be "recoveries" for the service, even
                        #        though recoveries really don't apply to this type of check.
                        #
                        #    3.  You *must* supply a different <old_file_log> for each service that
                        #        you define to use this plugin script - even if the different services
                        #        check the same <log_file> for pattern matches.  This is necessary
                        #        because of the way the script operates.
                        #
                        # Examples:
                        #
                        # Check for login failures in the syslog...
                        #
                        #   check_log /var/log/messages ./check_log.badlogins.old "LOGIN FAILURE"
                        #
                        # Check for port scan alerts generated by Psionic's PortSentry software...
                        #
                        #   check_log /var/log/message ./check_log.portscan.old "attackalert"
                        #

                        # Paths to commands used in this script.  These
                        # may have to be modified to match your system setup.
                        # TV: removed PATH restriction. Need to think more about what this means overall
                        #PATH=""

                        ECHO="/bin/echo"
                        GREP="/bin/egrep"
                        DIFF="/bin/diff"
                        TAIL="/bin/tail"
                        CAT="/bin/cat"
                        RM="/bin/rm"
                        CHMOD="/bin/chmod"
                        TOUCH="/bin/touch"

                        PROGNAME=`/bin/basename $0`
                        PROGPATH=`echo $0 | sed -e 's,[\\/][^\\/][^\\/]*$,,'`
                        REVISION="@NP_VERSION@"

                        . $PROGPATH/utils.sh

                        print_usage() {
                        echo "Usage: $PROGNAME -F logfile -O oldlog -q query"
                        echo "Usage: $PROGNAME --help"
                        echo "Usage: $PROGNAME --version"
                        }

                        print_help() {
                        print_revision $PROGNAME $REVISION
                        echo ""
                        print_usage
                        echo ""
                        echo "Log file pattern detector plugin for Nagios"
                        echo ""
                        support
                        }

                        # Make sure the correct number of command line
                        # arguments have been supplied

                        if [ $# -lt 1 ]; then
                        print_usage
                        exit $STATE_UNKNOWN
                        fi

                        # Grab the command line arguments

                        #logfile=$1
                        #oldlog=$2
                        #query=$3
                        exitstatus=$STATE_WARNING #default
                        while test -n "$1"; do
                        case "$1" in
                            --help)
                                print_help
                                exit $STATE_OK
                                ;;
                            -h)
                                print_help
                                exit $STATE_OK
                                ;;
                            --version)
                                print_revision $PROGNAME $REVISION
                                exit $STATE_OK
                                ;;
                            -V)
                                print_revision $PROGNAME $REVISION
                                exit $STATE_OK
                                ;;
                            --filename)
                                logfile=$2
                                shift
                                ;;
                            -F)
                                logfile=$2
                                shift
                                ;;
                            --oldlog)
                                oldlog=$2
                                shift
                                ;;
                            -O)
                                oldlog=$2
                                shift
                                ;;
                            --query)
                                query=$2
                                shift
                                ;;
                            -q)
                                query=$2
                                shift
                                ;;
                            -x)
                                exitstatus=$2
                                shift
                                ;;
                            --exitstatus)
                                exitstatus=$2
                                shift
                                ;;
                            *)
                                echo "Unknown argument: $1"
                                print_usage
                                exit $STATE_UNKNOWN
                                ;;
                        esac
                        shift
                        done

                        # If the source log file doesn't exist, exit

                        if [ ! -e $logfile ]; then
                        $ECHO "Log check error: Log file $logfile does not exist!\n"
                        exit $STATE_UNKNOWN
                        elif [ ! -r $logfile ] ; then
                        $ECHO "Log check error: Log file $logfile is not readable!\n"
                        exit $STATE_UNKNOWN
                        fi

                        # If the old log file doesn't exist, this must be the first time
                        # we're running this test, so copy the original log file over to
                        # the old diff file and exit

                        if [ ! -e $oldlog ]; then
                        $CAT $logfile > $oldlog
                        $ECHO "Log check data initialized...\n"
                        exit $STATE_OK
                        fi

                        # The old log file exists, so compare it to the original log now

                        # The temporary file that the script should use while
                        # processing the log file.
                        if [ -x /bin/mktemp ]; then
                        tempdiff=`/bin/mktemp /tmp/check_log.XXXXXXXXXX`
                        else
                        tempdiff=`/bin/date '+%H%M%S'`
                        tempdiff="/tmp/check_log.${tempdiff}"
                        $TOUCH $tempdiff
                        $CHMOD 600 $tempdiff
                        fi

                        $DIFF $logfile $oldlog | $GREP -v "^>" > $tempdiff

                        # Count the number of matching log entries we have
                        count=`$GREP -c "$query" $tempdiff`

                        # Get the last matching entry in the diff file
                        lastentry=`$GREP "$query" $tempdiff | $TAIL -1`

                        $RM -f $tempdiff
                        $CAT $logfile > $oldlog

                        if [ "$count" = "0" ]; then # no matches, exit with no error
                        $ECHO "Log check ok - 0 pattern matches found\n"
                        exitstatus=$STATE_OK
                        else # Print total matche count and the last entry we found
                        $ECHO "($count) $lastentry"
                        exitstatus=$STATE_CRITICAL
                        fi

                        exit $exitstatus

But be warned, I have not run this one, so if it shows some errors, you will have to modify them on your own.

you have to add this line in commands.cfg

    define command{
          command_name    check_log
          command_line    $USER1$/check_log -F $CURRENTLOG -O $OLDLOG -q $PATTERN

        }

Define the service in localhost.cfg

      define service{

      use  local-service           ; Inherit default values from a template

      host_name      localhost

      service_description   check_log

     check_command check_log!/var/log/secure!/usr/local/nagios/libexec/secure.my!"Failed password"

     }

Second Answer:(A little innovative) :

As far as i know, the log file for nagios is kept in the following place : /var/log/httpd/access_log

Now your log file like every log will contain time stamp information.So here we need to record the system time when the server is started. From my experience i can say that when we start WAS it spawns a java.exe process. I don't know what it is called in nagios. Let us consider it is LNT.exe. So we need to find the spawn time for LNT.exe .

Start the server now, logs will be generated. Now you need to read the logs in the log file only after this time to see only the current logs.

First get the id of the process : ps -ef LNT.exe and store it in variable processID

Then do this : ls -ld /proc/processID and store the time in variable startedTime

Now you have to read the file line by line and you have to compare the time you get with the startedTime. If startedTime>timeRead, then you have got to take that point as the benchmark and then you have to start reading the file from that location.

Hope that helps you.

share|improve this answer
    
Thanks a lot for the kind and interesting answer, i wil try this and then reply back to u if any issues occur. –  Manroop Oct 18 '12 at 6:08
    
Sure, u r welcome mate –  The Dark Knight Oct 18 '12 at 6:45
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.