using 'check_log ' to find and not find

[Gerhard Lausser]

Hi Ryan and all others,

> i have been looking around a bit, but haven't found anything. 
> anyone know if there is a version of check_log floating 
> around that will allow me to do a find and a not find?
i just released check_logfiles 1.3.2 which is capable of what you're looking
for.
http://sourceforge.net/projects/check-logfiles


> grep "\[\s*ERROR\s*\]\s" | grep -v "test" foo.log
> 
> where i use check_log to find log entries with "[ERROR]" but 
> ignore log entries that have "[ERROR]" and "test" together in 
> the same log entry.
you would express it in the configuration file like this:

    ...
    criticalpatterns => '\[ERROR\]',
    criticalexceptions => ['\[ERROR\].*test.*', '\[ERROR\].*joke.*'],
    ...

let's assume your logfile looks like this:

Jul 26 23:27:25 localhost -- MARK --
Jul 26 23:51:01 localhost something: [ERROR] somethings wrong #1
Jul 27 01:51:01 localhost some other blabla blabla
Jul 27 01:51:02 localhost something: [ERROR] no no just a test
Jul 27 01:51:04 localhost something: [ERROR] somethings wrong #2
Jul 27 01:51:07 localhost something: [ERROR] somethings wrong #3 haha just a
joke

then the plugin would produce an output like:

CRITICAL - (2 errors in check_somelogfiles.protocol-2006-07-27-20-52-42) -
Jul 27 01:51:01 localhost something: [ERROR] somethings wrong #2 ...

where you see the last valid match and a reference to a protocol file
containing all valid matches:

# cat tmp/check_somelogfiles.protocol-2006-07-27-20-52-42 
Critical Errors in messages
Jul 26 23:51:01 localhost something: [ERROR] somethings wrong #1
Jul 27 01:51:04 localhost something: [ERROR] somethings wrong #2

i hope it is useful for you.

Greetings from Munich,
Gerhard


-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys -- and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
_______________________________________________
Nagios-users mailing list
Nagios-users at lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/nagios-users
::: Please include Nagios version, plugin version (-v) and OS when reporting any issue. 
::: Messages without supporting info will risk being sent to /dev/null