CheckLogFile
File for checking log files and various other forms of updating text files

CheckLogFile — CheckLogFile

File for checking log files and various other forms of updating text files

Queries (Overview):

A list of all available queries (check commands)

Command Description
check_logfile Check for errors in log file or generic pattern matching in text files.

Aliases (Overview):

A list of all short hand aliases for queries (check commands)

Command Description
checklogfile Alias for: check_logfile

Commands (Overview):

TODO: Add a list of all external commands (this is not check commands)

Configuration (Overview):

Common Keys:

Path / Section Key Description
/settings/logfile/real-time enabled REAL TIME CHECKING

Sample keys:

Path / Section Key Default Value Description
/settings/logfile/real-time/checks/sample alias ALIAS  
/settings/logfile/real-time/checks/sample column split COLUMN SPLIT  
/settings/logfile/real-time/checks/sample command COMMAND NAME  
/settings/logfile/real-time/checks/sample critical CRITICAL FILTER  
/settings/logfile/real-time/checks/sample debug DEBUG  
/settings/logfile/real-time/checks/sample destination DESTINATION  
/settings/logfile/real-time/checks/sample detail syntax SYNTAX  
/settings/logfile/real-time/checks/sample empty message EMPTY MESSAGE  
/settings/logfile/real-time/checks/sample file FILE  
/settings/logfile/real-time/checks/sample files FILES  
/settings/logfile/real-time/checks/sample filter FILTER  
/settings/logfile/real-time/checks/sample is template IS TEMPLATE  
/settings/logfile/real-time/checks/sample maximum age MAGIMUM AGE  
/settings/logfile/real-time/checks/sample ok OK FILTER  
/settings/logfile/real-time/checks/sample ok syntax SYNTAX  
/settings/logfile/real-time/checks/sample parent PARENT  
/settings/logfile/real-time/checks/sample perf config PERF CONFIG  
/settings/logfile/real-time/checks/sample severity SEVERITY  
/settings/logfile/real-time/checks/sample target DESTINATION  
/settings/logfile/real-time/checks/sample top syntax SYNTAX  
/settings/logfile/real-time/checks/sample warning WARNING FILTER  

Queries

A quick reference for all available queries (check commands) in the CheckLogFile module.

check_logfile

CheckLogFilecheck_logfile
Check for errors in log file or generic pattern matching in text files.

Usage:

Option Default Value Description
help N/A Show help screen (this screen)
help-pb N/A Show help screen as a protocol buffer payload
show-default N/A Show default values for a given command
help-short N/A Show help screen (short format).
debug N/A Show debugging information in the log
show-all N/A Show debugging information in the log
filter   Filter which marks interesting items.
warning   Filter which marks items which generates a warning state.
warn   Short alias for warning
critical   Filter which marks items which generates a critical state.
crit   Short alias for critical.
ok   Filter which marks items which generates an ok state.
empty-state ignored Return status to use when nothing matched filter.
perf-config   Performance data generation configuration
top-syntax ${count}/${total} (${problem_list}) Top level syntax.
ok-syntax   ok syntax.
empty-syntax %(status): Nothing found Empty syntax.
detail-syntax ${column1} Detail level syntax.
perf-syntax ${column1} Performance alias syntax.
line-split n Character string used to split a file into several lines (default n)
column-split t Character string to split a line into several columns (default t)
split   Alias for split-column
file   File to read (can be specified multiple times to check multiple files.
files   A comma separated list of files to scan (same as file except a list)

Arguments

help (CheckLogFile, check_logfile)
Show help screen (this screen)
help-pb (CheckLogFile, check_logfile)
Show help screen as a protocol buffer payload
show-default (CheckLogFile, check_logfile)
Show default values for a given command
help-short (CheckLogFile, check_logfile)
Show help screen (short format).
debug (CheckLogFile, check_logfile)
Show debugging information in the log
show-all (CheckLogFile, check_logfile)
Show debugging information in the log
filter (CheckLogFile, check_logfile)
Filter which marks interesting items.
Interesting items are items which will be included in the check.
They do not denote warning or critical state but they are checked use this to filter out unwanted items.
Available options:

column1 column2 column3 column4 column5 column6 column7 column8 column9 file filename line column() Syntax: column(<coulmn number>) count total ok_count warn_count crit_count problem_count list ok_list warn_list crit_list problem_list detail_list status ================================

warning (CheckLogFile, check_logfile)
Filter which marks items which generates a warning state.
If anything matches this filter the return status will be escalated to warning.
Available options:

column1 column2 column3 column4 column5 column6 column7 column8 column9 file filename line column() Syntax: column(<coulmn number>) count total ok_count warn_count crit_count problem_count list ok_list warn_list crit_list problem_list detail_list status ================================

warn (CheckLogFile, check_logfile)
Short alias for warning
critical (CheckLogFile, check_logfile)
Filter which marks items which generates a critical state.
If anything matches this filter the return status will be escalated to critical.
Available options:

column1 column2 column3 column4 column5 column6 column7 column8 column9 file filename line column() Syntax: column(<coulmn number>) count total ok_count warn_count crit_count problem_count list ok_list warn_list crit_list problem_list detail_list status ================================

crit (CheckLogFile, check_logfile)
Short alias for critical.
ok (CheckLogFile, check_logfile)
Filter which marks items which generates an ok state.
If anything matches this any previous state for this item will be reset to ok.
Available options:

column1 column2 column3 column4 column5 column6 column7 column8 column9 file filename line column() Syntax: column(<coulmn number>) count total ok_count warn_count crit_count problem_count list ok_list warn_list crit_list problem_list detail_list status ================================

empty-state (CheckLogFile, check_logfile)
Return status to use when nothing matched filter.
If no filter is specified this will never happen unless the file is empty.
perf-config (CheckLogFile, check_logfile)
Performance data generation configuration
TODO: obj ( key: value; key: value) obj (key:valuer;key:value)
top-syntax (CheckLogFile, check_logfile)
Top level syntax.
Used to format the message to return can include strings as well as special keywords such as:
Key Value
%(column1) The value in the first column
%(column2) The value in the second column
%(column3) The value in the third column
%(column4) The value in the 4:th column
%(column5) The value in the 5:th column
%(column6) The value in the 6:th column
%(column7) The value in the 7:th column
%(column8) The value in the 8:th column
%(column9) The value in the 9:th column
%(file) The name of the file
%(filename) The name of the file
%(line) Match the content of an entire line
${count} Number of items matching the filter
${total} Total number of items
${ok_count} Number of items matched the ok criteria
${warn_count} Number of items matched the warning criteria
${crit_count} Number of items matched the critical criteria
${problem_count} Number of items matched either warning or critical criteria
${list} A list of all items which matched the filter
${ok_list} A list of all items which matched the ok criteria
${warn_list} A list of all items which matched the warning criteria
${crit_list} A list of all items which matched the critical criteria
${problem_list} A list of all items which matched either the critical or the warning criteria
${detail_list} A special list with critical, then warning and fainally ok
${status} The returned status (OK/WARN/CRIT/UNKNOWN)
ok-syntax (CheckLogFile, check_logfile)
ok syntax.
DEPRECATED! This is the syntax for when an ok result is returned.
This value will not be used if your syntax contains %(list) or %(count).
empty-syntax (CheckLogFile, check_logfile)
Empty syntax.
DEPRECATED! This is the syntax for when nothing matches the filter.
Possible values are:
Key Value
%(column1) The value in the first column
%(column2) The value in the second column
%(column3) The value in the third column
%(column4) The value in the 4:th column
%(column5) The value in the 5:th column
%(column6) The value in the 6:th column
%(column7) The value in the 7:th column
%(column8) The value in the 8:th column
%(column9) The value in the 9:th column
%(file) The name of the file
%(filename) The name of the file
%(line) Match the content of an entire line
${count} Number of items matching the filter
${total} Total number of items
${ok_count} Number of items matched the ok criteria
${warn_count} Number of items matched the warning criteria
${crit_count} Number of items matched the critical criteria
${problem_count} Number of items matched either warning or critical criteria
${list} A list of all items which matched the filter
${ok_list} A list of all items which matched the ok criteria
${warn_list} A list of all items which matched the warning criteria
${crit_list} A list of all items which matched the critical criteria
${problem_list} A list of all items which matched either the critical or the warning criteria
${detail_list} A special list with critical, then warning and fainally ok
${status} The returned status (OK/WARN/CRIT/UNKNOWN)
detail-syntax (CheckLogFile, check_logfile)
Detail level syntax.
This is the syntax of each item in the list of top-syntax (see above).
Possible values are:
Key Value
%(column1) The value in the first column
%(column2) The value in the second column
%(column3) The value in the third column
%(column4) The value in the 4:th column
%(column5) The value in the 5:th column
%(column6) The value in the 6:th column
%(column7) The value in the 7:th column
%(column8) The value in the 8:th column
%(column9) The value in the 9:th column
%(file) The name of the file
%(filename) The name of the file
%(line) Match the content of an entire line
${count} Number of items matching the filter
${total} Total number of items
${ok_count} Number of items matched the ok criteria
${warn_count} Number of items matched the warning criteria
${crit_count} Number of items matched the critical criteria
${problem_count} Number of items matched either warning or critical criteria
${list} A list of all items which matched the filter
${ok_list} A list of all items which matched the ok criteria
${warn_list} A list of all items which matched the warning criteria
${crit_list} A list of all items which matched the critical criteria
${problem_list} A list of all items which matched either the critical or the warning criteria
${detail_list} A special list with critical, then warning and fainally ok
${status} The returned status (OK/WARN/CRIT/UNKNOWN)
perf-syntax (CheckLogFile, check_logfile)
Performance alias syntax.
This is the syntax for the base names of the performance data.
Possible values are:
Key Value
%(column1) The value in the first column
%(column2) The value in the second column
%(column3) The value in the third column
%(column4) The value in the 4:th column
%(column5) The value in the 5:th column
%(column6) The value in the 6:th column
%(column7) The value in the 7:th column
%(column8) The value in the 8:th column
%(column9) The value in the 9:th column
%(file) The name of the file
%(filename) The name of the file
%(line) Match the content of an entire line
${count} Number of items matching the filter
${total} Total number of items
${ok_count} Number of items matched the ok criteria
${warn_count} Number of items matched the warning criteria
${crit_count} Number of items matched the critical criteria
${problem_count} Number of items matched either warning or critical criteria
${list} A list of all items which matched the filter
${ok_list} A list of all items which matched the ok criteria
${warn_list} A list of all items which matched the warning criteria
${crit_list} A list of all items which matched the critical criteria
${problem_list} A list of all items which matched either the critical or the warning criteria
${detail_list} A special list with critical, then warning and fainally ok
${status} The returned status (OK/WARN/CRIT/UNKNOWN)
line-split (CheckLogFile, check_logfile)
Character string used to split a file into several lines (default n)
column-split (CheckLogFile, check_logfile)
Character string to split a line into several columns (default t)
split (CheckLogFile, check_logfile)
Alias for split-column
file (CheckLogFile, check_logfile)
File to read (can be specified multiple times to check multiple files.
Notice that specifying multiple files will create an aggregate set it will not check each file individually.
In other words if one file contains an error the entire check will result in error or if you check the count it is the global count which is used.
files (CheckLogFile, check_logfile)
A comma separated list of files to scan (same as file except a list)

/ settings/ logfile

/settings/logfile (CheckLogFile)

LOG FILE SECTION

Section for log file checker

Sample:

# LOG FILE SECTION
# Section for log file checker
[/settings/logfile]

… / real-time

/settings/logfile/real-time (CheckLogFile)

CONFIGURE REALTIME CHECKING

A set of options to configure the real time checks
Key Default Value Description
enabled 0 REAL TIME CHECKING

Sample:

# CONFIGURE REALTIME CHECKING
# A set of options to configure the real time checks
[/settings/logfile/real-time]
enabled=0
enabled (CheckLogFile, /settings/logfile/real-time)

REAL TIME CHECKING

Spawns a background thread which waits for file changes.

Path: /settings/logfile/real-time

Key: enabled

Default value: 0

Used by: CheckLogFile

Sample:

[/settings/logfile/real-time]
# REAL TIME CHECKING
enabled=0

… / real-time / checks

/settings/logfile/real-time/checks (CheckLogFile)

REALTIME FILTERS

A set of filters to use in real-time mode

Sample:

# REALTIME FILTERS
# A set of filters to use in real-time mode
[/settings/logfile/real-time/checks]

… / real-time / checks / sample

/settings/logfile/real-time/checks/sample (CheckLogFile)

REAL TIME FILTER DEFENITION

Definition for real time filter: sample
Key Default Value Description
alias   ALIAS
column split   COLUMN SPLIT
command   COMMAND NAME
critical   CRITICAL FILTER
debug 0 DEBUG
destination   DESTINATION
detail syntax   SYNTAX
empty message eventlog found no records EMPTY MESSAGE
file   FILE
files   FILES
filter   FILTER
is template 0 IS TEMPLATE
maximum age 5m MAGIMUM AGE
ok   OK FILTER
ok syntax   SYNTAX
parent default PARENT
perf config   PERF CONFIG
severity   SEVERITY
target   DESTINATION
top syntax   SYNTAX
warning   WARNING FILTER

Sample:

# REAL TIME FILTER DEFENITION
# Definition for real time filter: sample
[/settings/logfile/real-time/checks/sample]
alias=
column split=
command=
critical=
debug=0
destination=
detail syntax=
empty message=eventlog found no records
file=
files=
filter=
is template=0
maximum age=5m
ok=
ok syntax=
parent=default
perf config=
severity=
target=
top syntax=
warning=
alias (CheckLogFile, /settings/logfile/real-time/checks/sample)

ALIAS

The alias (service name) to report to server

Advanced (means it is not commonly used)

Path: /settings/logfile/real-time/checks/sample

Key: alias

Default value:

Sample key: This key is provided as a sample to show how to configure objects

Used by: CheckLogFile

Sample:

[/settings/logfile/real-time/checks/sample]
# ALIAS
alias=
column split (CheckLogFile, /settings/logfile/real-time/checks/sample)

COLUMN SPLIT

THe character(s) to use when splitting on column level

Advanced (means it is not commonly used)

Path: /settings/logfile/real-time/checks/sample

Key: column split

Default value:

Sample key: This key is provided as a sample to show how to configure objects

Used by: CheckLogFile

Sample:

[/settings/logfile/real-time/checks/sample]
# COLUMN SPLIT
column split=
command (CheckLogFile, /settings/logfile/real-time/checks/sample)

COMMAND NAME

The name of the command (think nagios service name) to report up stream (defaults to alias if not set)

Advanced (means it is not commonly used)

Path: /settings/logfile/real-time/checks/sample

Key: command

Default value:

Sample key: This key is provided as a sample to show how to configure objects

Used by: CheckLogFile

Sample:

[/settings/logfile/real-time/checks/sample]
# COMMAND NAME
command=
critical (CheckLogFile, /settings/logfile/real-time/checks/sample)

CRITICAL FILTER

If any rows match this filter severity will escalated to CRITICAL

Path: /settings/logfile/real-time/checks/sample

Key: critical

Default value:

Sample key: This key is provided as a sample to show how to configure objects

Used by: CheckLogFile

Sample:

[/settings/logfile/real-time/checks/sample]
# CRITICAL FILTER
critical=
debug (CheckLogFile, /settings/logfile/real-time/checks/sample)

DEBUG

Enable this to display debug information for this match filter

Advanced (means it is not commonly used)

Path: /settings/logfile/real-time/checks/sample

Key: debug

Default value: 0

Sample key: This key is provided as a sample to show how to configure objects

Used by: CheckLogFile

Sample:

[/settings/logfile/real-time/checks/sample]
# DEBUG
debug=0
destination (CheckLogFile, /settings/logfile/real-time/checks/sample)

DESTINATION

The destination for intercepted messages

Advanced (means it is not commonly used)

Path: /settings/logfile/real-time/checks/sample

Key: destination

Default value:

Sample key: This key is provided as a sample to show how to configure objects

Used by: CheckLogFile

Sample:

[/settings/logfile/real-time/checks/sample]
# DESTINATION
destination=
detail syntax (CheckLogFile, /settings/logfile/real-time/checks/sample)

SYNTAX

Format string for dates

Advanced (means it is not commonly used)

Path: /settings/logfile/real-time/checks/sample

Key: detail syntax

Default value:

Sample key: This key is provided as a sample to show how to configure objects

Used by: CheckLogFile

Sample:

[/settings/logfile/real-time/checks/sample]
# SYNTAX
detail syntax=
empty message (CheckLogFile, /settings/logfile/real-time/checks/sample)

EMPTY MESSAGE

The message to display if nothing matches the filter (generally considered the ok state).

Advanced (means it is not commonly used)

Path: /settings/logfile/real-time/checks/sample

Key: empty message

Default value: eventlog found no records

Sample key: This key is provided as a sample to show how to configure objects

Used by: CheckLogFile

Sample:

[/settings/logfile/real-time/checks/sample]
# EMPTY MESSAGE
empty message=eventlog found no records
file (CheckLogFile, /settings/logfile/real-time/checks/sample)

FILE

The eventlog record to filter on (if set to ‘all’ means all enabled logs)

Path: /settings/logfile/real-time/checks/sample

Key: file

Default value:

Sample key: This key is provided as a sample to show how to configure objects

Used by: CheckLogFile

Sample:

[/settings/logfile/real-time/checks/sample]
# FILE
file=
files (CheckLogFile, /settings/logfile/real-time/checks/sample)

FILES

The eventlog record to filter on (if set to ‘all’ means all enabled logs)

Advanced (means it is not commonly used)

Path: /settings/logfile/real-time/checks/sample

Key: files

Default value:

Sample key: This key is provided as a sample to show how to configure objects

Used by: CheckLogFile

Sample:

[/settings/logfile/real-time/checks/sample]
# FILES
files=
filter (CheckLogFile, /settings/logfile/real-time/checks/sample)

FILTER

Scan files for matching rows for each matching rows an OK message will be submitted

Path: /settings/logfile/real-time/checks/sample

Key: filter

Default value:

Sample key: This key is provided as a sample to show how to configure objects

Used by: CheckLogFile

Sample:

[/settings/logfile/real-time/checks/sample]
# FILTER
filter=
is template (CheckLogFile, /settings/logfile/real-time/checks/sample)

IS TEMPLATE

Declare this object as a template (this means it will not be available as a separate object)

Advanced (means it is not commonly used)

Path: /settings/logfile/real-time/checks/sample

Key: is template

Default value: 0

Sample key: This key is provided as a sample to show how to configure objects

Used by: CheckLogFile

Sample:

[/settings/logfile/real-time/checks/sample]
# IS TEMPLATE
is template=0
maximum age (CheckLogFile, /settings/logfile/real-time/checks/sample)

MAGIMUM AGE

How long before reporting “ok”.
If this is set to “false” no periodic ok messages will be reported only errors.

Path: /settings/logfile/real-time/checks/sample

Key: maximum age

Default value: 5m

Sample key: This key is provided as a sample to show how to configure objects

Used by: CheckLogFile

Sample:

[/settings/logfile/real-time/checks/sample]
# MAGIMUM AGE
maximum age=5m
ok (CheckLogFile, /settings/logfile/real-time/checks/sample)

OK FILTER

If any rows match this filter severity will escalated down to OK

Path: /settings/logfile/real-time/checks/sample

Key: ok

Default value:

Sample key: This key is provided as a sample to show how to configure objects

Used by: CheckLogFile

Sample:

[/settings/logfile/real-time/checks/sample]
# OK FILTER
ok=
ok syntax (CheckLogFile, /settings/logfile/real-time/checks/sample)

SYNTAX

Format string for dates

Advanced (means it is not commonly used)

Path: /settings/logfile/real-time/checks/sample

Key: ok syntax

Default value:

Sample key: This key is provided as a sample to show how to configure objects

Used by: CheckLogFile

Sample:

[/settings/logfile/real-time/checks/sample]
# SYNTAX
ok syntax=
parent (CheckLogFile, /settings/logfile/real-time/checks/sample)

PARENT

The parent the target inherits from

Advanced (means it is not commonly used)

Path: /settings/logfile/real-time/checks/sample

Key: parent

Default value: default

Sample key: This key is provided as a sample to show how to configure objects

Used by: CheckLogFile

Sample:

[/settings/logfile/real-time/checks/sample]
# PARENT
parent=default
perf config (CheckLogFile, /settings/logfile/real-time/checks/sample)

PERF CONFIG

Performance data configuration

Advanced (means it is not commonly used)

Path: /settings/logfile/real-time/checks/sample

Key: perf config

Default value:

Sample key: This key is provided as a sample to show how to configure objects

Used by: CheckLogFile

Sample:

[/settings/logfile/real-time/checks/sample]
# PERF CONFIG
perf config=
severity (CheckLogFile, /settings/logfile/real-time/checks/sample)

SEVERITY

THe severity of this message (OK, WARNING, CRITICAL, UNKNOWN)

Advanced (means it is not commonly used)

Path: /settings/logfile/real-time/checks/sample

Key: severity

Default value:

Sample key: This key is provided as a sample to show how to configure objects

Used by: CheckLogFile

Sample:

[/settings/logfile/real-time/checks/sample]
# SEVERITY
severity=
target (CheckLogFile, /settings/logfile/real-time/checks/sample)

DESTINATION

Same as destination

Path: /settings/logfile/real-time/checks/sample

Key: target

Default value:

Sample key: This key is provided as a sample to show how to configure objects

Used by: CheckLogFile

Sample:

[/settings/logfile/real-time/checks/sample]
# DESTINATION
target=
top syntax (CheckLogFile, /settings/logfile/real-time/checks/sample)

SYNTAX

Format string for dates

Advanced (means it is not commonly used)

Path: /settings/logfile/real-time/checks/sample

Key: top syntax

Default value:

Sample key: This key is provided as a sample to show how to configure objects

Used by: CheckLogFile

Sample:

[/settings/logfile/real-time/checks/sample]
# SYNTAX
top syntax=
warning (CheckLogFile, /settings/logfile/real-time/checks/sample)

WARNING FILTER

If any rows match this filter severity will escalated to WARNING

Path: /settings/logfile/real-time/checks/sample

Key: warning

Default value:

Sample key: This key is provided as a sample to show how to configure objects

Used by: CheckLogFile

Sample:

[/settings/logfile/real-time/checks/sample]
# WARNING FILTER
warning=
comments powered by Disqus