Using check-log.rb

I’m trying to setup the check-log.rb from the sensu-community-plugins repo to do a simple regex pattern match on log files and then throw a warning/critical if found.

I’m manually testing the script on /var/log/messages looking for the word “interface” like this:

/opt/sensu/embedded/bin/ruby check-log.rb -F /var/log/messages -q ‘/interface/’

I get the output:

CheckLog OK: 0 warnings, 0 criticals for pattern /interface/.

I know the pattern matches with /interface/ because interface exists in the /var/log/messages file. So my question would be is how do I setup this script (what arguments to pass) for a warn and critical event to be triggered?

There’s not a lot of documentation and when I try doing -w 1 (expecting that a count of 1 for warning will trigger a warning), nothing happens, I get the same output: CheckLog OK: 0 warnings, 0 criticals for pattern /interface/.

Any thoughts on this?

Thanks,

James

I think you may be misunderstanding what this script does. It is not
like grep where it just looks through the whole file and returns if
the string is found. (except on the first run)

Re-read the description to be sure this is the check you want:

(new location)

Remember that Sensu just runs stuff, so if this particular check
command doesn't do what you want, you can use any other
nagios-compliant script, or write your own.

···

On Tue, Aug 4, 2015 at 1:43 PM, James Jelinek <jelinek@gmail.com> wrote:

I'm trying to setup the check-log.rb from the sensu-community-plugins repo
to do a simple regex pattern match on log files and then throw a
warning/critical if found.

I'm manually testing the script on /var/log/messages looking for the word
"interface" like this:

/opt/sensu/embedded/bin/ruby check-log.rb -F /var/log/messages -q
'/interface/'

I get the output:

CheckLog OK: 0 warnings, 0 criticals for pattern /interface/.

I know the pattern matches with /interface/ because interface exists in the
/var/log/messages file. So my question would be is how do I setup this
script (what arguments to pass) for a warn and critical event to be
triggered?

There's not a lot of documentation and when I try doing -w 1 (expecting that
a count of 1 for warning will trigger a warning), nothing happens, I get the
same output: CheckLog OK: 0 warnings, 0 criticals for pattern /interface/.

Any thoughts on this?

Thanks,

James

I think you’re right. This script doesn’t do what I’m wanting it to do. Can you suggest a simple grep-style bash/nagios script instead?

Thanks for your help as always, Kyle!

···

On Tuesday, August 4, 2015 at 9:36:24 PM UTC-5, Kyle Anderson wrote:

I think you may be misunderstanding what this script does. It is not
like grep where it just looks through the whole file and returns if
the string is found. (except on the first run)

Re-read the description to be sure this is the check you want:
https://github.com/sensu/sensu-community-plugins/blob/af719c4a11a088ad5f601520a95ff1dd09ea31d9/plugins/logging/check-log.rb#L6-L10

https://github.com/sensu-plugins/sensu-plugins-logs/blob/ad1d588646b53bc52db213bc0158fcc9a316bf6f/bin/check-log.rb#L6-L10

(new location)

Remember that Sensu just runs stuff, so if this particular check
command doesn’t do what you want, you can use any other
nagios-compliant script, or write your own.

On Tue, Aug 4, 2015 at 1:43 PM, James Jelinek jel...@gmail.com wrote:

I’m trying to setup the check-log.rb from the sensu-community-plugins repo
to do a simple regex pattern match on log files and then throw a
warning/critical if found.

I’m manually testing the script on /var/log/messages looking for the word
“interface” like this:

/opt/sensu/embedded/bin/ruby check-log.rb -F /var/log/messages -q
‘/interface/’

I get the output:

CheckLog OK: 0 warnings, 0 criticals for pattern /interface/.

I know the pattern matches with /interface/ because interface exists in the
/var/log/messages file. So my question would be is how do I setup this
script (what arguments to pass) for a warn and critical event to be
triggered?

There’s not a lot of documentation and when I try doing -w 1 (expecting that
a count of 1 for warning will trigger a warning), nothing happens, I get the
same output: CheckLog OK: 0 warnings, 0 criticals for pattern /interface/.

Any thoughts on this?

Thanks,

James

Any suggestions on a simple sh or pl script that will do a simple grep of a log file to return warning/critical/ok?

-James

···

On Aug 4, 2015, at 9:36 PM, Kyle Anderson <kyle@xkyle.com> wrote:

I think you may be misunderstanding what this script does. It is not
like grep where it just looks through the whole file and returns if
the string is found. (except on the first run)

Re-read the description to be sure this is the check you want:
https://github.com/sensu/sensu-community-plugins/blob/af719c4a11a088ad5f601520a95ff1dd09ea31d9/plugins/logging/check-log.rb#L6-L10
https://github.com/sensu-plugins/sensu-plugins-logs/blob/ad1d588646b53bc52db213bc0158fcc9a316bf6f/bin/check-log.rb#L6-L10
(new location)

Remember that Sensu just runs stuff, so if this particular check
command doesn't do what you want, you can use any other
nagios-compliant script, or write your own.

On Tue, Aug 4, 2015 at 1:43 PM, James Jelinek <jelinek@gmail.com> wrote:

I'm trying to setup the check-log.rb from the sensu-community-plugins repo
to do a simple regex pattern match on log files and then throw a
warning/critical if found.

I'm manually testing the script on /var/log/messages looking for the word
"interface" like this:

/opt/sensu/embedded/bin/ruby check-log.rb -F /var/log/messages -q
'/interface/'

I get the output:

CheckLog OK: 0 warnings, 0 criticals for pattern /interface/.

I know the pattern matches with /interface/ because interface exists in the
/var/log/messages file. So my question would be is how do I setup this
script (what arguments to pass) for a warn and critical event to be
triggered?

There's not a lot of documentation and when I try doing -w 1 (expecting that
a count of 1 for warning will trigger a warning), nothing happens, I get the
same output: CheckLog OK: 0 warnings, 0 criticals for pattern /interface/.

Any thoughts on this?

Thanks,

James