\>\> wrote:
> > > \> Hi,
> > > \>
> > > \> I'm using the check\_log to check my logfiles on certain keywords, for
> > > \> example "error". If a new error is written to the log file, sensu gives me
> > > \> an error. After a couple of seconds, the critical error disappears. How
> > > \> should I configure my check in order to check the log file on a word like
> > > \> ERROR and that the error stays as long the error exists in the log file?
> > > \>
> > > \>
> > > \> My check looks a bit like this:
> > > \>
> > > \> {
> > > \> "checks": {
> > > \> "check\_log": {
> > > \> "command": "/etc/sensu/plugins/check-log.rb -f
> > > \> /opt/test/logs/testDocker.log -q 'ERROR'",
> > > \> "interval": 10,
> > > \> "subscribers": ["subscriber1"]
> > > \> }
> > > \> }
> > > \> }
> > > \>
> > > \> Thanks in advance!
---
### Author:  [@James\_Jelinek](https://discourse.sensu.io/u/James_Jelinek)
#### Post date: [August 5, 2015, 5:19pm UTC](https://discourse.sensu.io/t/how-to-make-check-for-check-log-rb/456/5 "2015-08-05T17:19:56Z")
I got the check-log.rb to work with the help of the Sensu dev guys.
Here’s the command I run in my definition
/etc/sensu/plugins/check-log.rb -s /tmp/cache/check-log -f /path/to/log.file -q Error -w ‘1’ -c
‘2’"
This will result in critical or warning being issued the first time, but when it runs the check again it will zero out the results because it already read the file and stored it in cache. The fix to keep the alert alive was given by Sean Porter of Sensu and that’s to include “auto\_resolve”: false, in the check definition so the critical or warning alert persists.
So far this is working in my environment. My bigger issue is, my log file names change every day. So I’m trying to figure out a way to symlink the latest log file to /var/log/latestimport.log and have this happen every day.
Any thoughts on dynamic symlinking based off of mtime?
> **···**
>
> > On Aug 5, 2015, at 9:42 AM, Kyle Anderson [kyle@xkyle.com](mailto:kyle@xkyle.com) wrote:
>
> > I don’t have any good suggestions, the first google hit for “nagios
> > check grep” is this:
> > [https://exchange.nagios.org/directory/Plugins/Operating-Systems/Linux/check-grep-command-output/details](https://exchange.nagios.org/directory/Plugins/Operating-Systems/Linux/check-grep-command-output/details)
> >
> > On Wed, Aug 5, 2015 at 6:58 AM, James Jelinek [jelinek@gmail.com](mailto:jelinek@gmail.com) wrote:
> >
> > > Kyle,
> > >
> > > Can you suggest a simple grep style script which will return ok, warn,
> > > critical so I can parse a log file for a keyword?
> > >
> > > If I used ! grep ERROR /path/to/log.file how would I get the OK and Warnings
> > > into sensu?
> > >
> > > -james
> > >
> > > On Saturday, July 4, 2015 at 7:31:18 PM UTC-5, Kyle Anderson wrote:
> > >
> > > > The community check-log is not designed to work like that:
> > > >
> > > > [https://github.com/sensu/sensu-community-plugins/blob/af719c4a11a088ad5f601520a95ff1dd09ea31d9/plugins/logging/check-log.rb#L6](https://github.com/sensu/sensu-community-plugins/blob/af719c4a11a088ad5f601520a95ff1dd09ea31d9/plugins/logging/check-log.rb#L6)
> > > >
> > > > You could use any nagios-compliant check-grep style script, or even
> > > > KISS with “! grep ERROR /opt/test/logs/testDocker.log”? (only would
> > > > ever return ok or warn though)
> > > >
> > > > On Fri, Jul 3, 2015 at 1:47 PM, Romario Lodder [romari...@gmail.com](mailto:romari...@gmail.com) \> \> \> wrote:
> > > >
> > > > > Hi,
> > > > >
> > > > > I’m using the check\_log to check my logfiles on certain keywords, for
> > > > > example “error”. If a new error is written to the log file, sensu gives me
> > > > > an error. After a couple of seconds, the critical error disappears. How
> > > > > should I configure my check in order to check the log file on a word like
> > > > > ERROR and that the error stays as long the error exists in the log file?
> > > > >
> > > > > My check looks a bit like this:
> > > > >
> > > > > {
> > > > > “checks”: {
> > > > > “check\_log”: {
> > > > > “command”: “/etc/sensu/plugins/check-log.rb -f
> > > > > /opt/test/logs/testDocker.log -q ‘ERROR’”,
> > > > > “interval”: 10,
> > > > > “subscribers”: [“subscriber1”]
> > > > > }
> > > > > }
> > > > > }
> > > > >
> > > > > Thanks in advance!
---
### Author:  [@Ethan\_Erchinger](https://discourse.sensu.io/u/Ethan_Erchinger)
#### Post date: [August 9, 2015, 5:47pm UTC](https://discourse.sensu.io/t/how-to-make-check-for-check-log-rb/456/6 "2015-08-09T17:47:16Z")
`ln -s $(ls -rt /path/to/file.* | tail -n1) /symlink/path`
---
### Author:  [@James\_Jelinek](https://discourse.sensu.io/u/James_Jelinek)
#### Post date: [August 9, 2015, 7:12pm UTC](https://discourse.sensu.io/t/how-to-make-check-for-check-log-rb/456/7 "2015-08-09T19:12:18Z")
This is exactly what I’m looking for. Thanks! Dynamic symlinking here i come 🙂
Appreciate it, Ethan!
> **···**
>
> > On Aug 9, 2015, at 12:47 PM, Ethan Erchinger \ wrote:
> >
> > `ln -s $(ls -rt /path/to/file.* | tail -n1) /symlink/path`
---
### Author:  [@Laz](https://discourse.sensu.io/u/Laz)
#### Post date: [February 5, 2016, 10:31am UTC](https://discourse.sensu.io/t/how-to-make-check-for-check-log-rb/456/8 "2016-02-05T10:31:31Z")
I have the same issue where the alert is cleared during the next check. As suggested, I tried adding “auto\_resolve”: false but still have the same issue.
Do I need to update the check-log.rb file ?.
Thanks for any suggestions.
> **···**
>
> On Wednesday, 5 August 2015 18:19:59 UTC+1, James Jelinek wrote:
>
> > I got the check-log.rb to work with the help of the Sensu dev guys.
>
> > Here’s the command I run in my definition
>
> >
>
> > /etc/sensu/plugins/check-log.rb -s /tmp/cache/check-log -f /path/to/log.file -q Error -w ‘1’ -c
>
> > ‘2’"
>
> >
>
> > This will result in critical or warning being issued the first time, but when it runs the check again it will zero out the results because it already read the file and stored it in cache. The fix to keep the alert alive was given by Sean Porter of Sensu and that’s to include “auto\_resolve”: false, in the check definition so the critical or warning alert persists.
>
> >
>
> > So far this is working in my environment. My bigger issue is, my log file names change every day. So I’m trying to figure out a way to symlink the latest log file to /var/log/latestimport.log and have this happen every day.
>
> >
>
> > Any thoughts on dynamic symlinking based off of mtime?
>
> >
>
> >
>
> > > On Aug 5, 2015, at 9:42 AM, Kyle Anderson [ky...@xkyle.com](mailto:ky...@xkyle.com) wrote:
>
> > > I don’t have any good suggestions, the first google hit for “nagios
> > > check grep” is this:
> > > [https://exchange.nagios.org/directory/Plugins/Operating-Systems/Linux/check-grep-command-output/details](https://exchange.nagios.org/directory/Plugins/Operating-Systems/Linux/check-grep-command-output/details)
> > >
> > > On Wed, Aug 5, 2015 at 6:58 AM, James Jelinek [jel...@gmail.com](mailto:jel...@gmail.com) wrote:
> > >
> > > > Kyle,
> > > >
> > > > Can you suggest a simple grep style script which will return ok, warn,
> > > > critical so I can parse a log file for a keyword?
> > > >
> > > > If I used ! grep ERROR /path/to/log.file how would I get the OK and Warnings
> > > > into sensu?
> > > >
> > > > -james
> > > >
> > > > On Saturday, July 4, 2015 at 7:31:18 PM UTC-5, Kyle Anderson wrote:
> > > >
> > > > > > Hi,
> > > > > >
> > > > > > I’m using the check\_log to check my logfiles on certain keywords, for
> > > > > > example “error”. If a new error is written to the log file, sensu gives me
> > > > > > an error. After a couple of seconds, the critical error disappears. How
> > > > > > should I configure my check in order to check the log file on a word like
> > > > > > ERROR and that the error stays as long the error exists in the log file?
> > > > > >
> > > > > > My check looks a bit like this:
> > > > > >
> > > > > > {
> > > > > > “checks”: {
> > > > > > “check\_log”: {
> > > > > > “command”: “/etc/sensu/plugins/check-log.rb -f
> > > > > > /opt/test/logs/testDocker.log -q ‘ERROR’”,
> > > > > > “interval”: 10,
> > > > > > “subscribers”: [“subscriber1”]
> > > > > > }
> > > > > > }
> > > > > > }
> > > > > >
> > > > > > Thanks in advance!
> > > > >
> > > > > The community check-log is not designed to work like that:
> > > > >
> > > > > [https://github.com/sensu/sensu-community-plugins/blob/af719c4a11a088ad5f601520a95ff1dd09ea31d9/plugins/logging/check-log.rb#L6](https://github.com/sensu/sensu-community-plugins/blob/af719c4a11a088ad5f601520a95ff1dd09ea31d9/plugins/logging/check-log.rb#L6)
> > > > >
> > > > > You could use any nagios-compliant check-grep style script, or even
> > > > > KISS with “! grep ERROR /opt/test/logs/testDocker.log”? (only would
> > > > > ever return ok or warn though)
> > > > >
> > > > > On Fri, Jul 3, 2015 at 1:47 PM, Romario Lodder [romari...@gmail.com](mailto:romari...@gmail.com) \> \> \> \> wrote:
>
> >