nagios.log format

[Kuang-Chun Cheng]

Hi Marc,

Thanks, this is good enough for me :-)

Regards
KC

On Nov 14, 2007 12:56 AM, Marc Powell <marc at ena.com> wrote:
>
>
> > -----Original Message-----
> > From: nagios-users-bounces at lists.sourceforge.net [mailto:nagios-users-
> > bounces at lists.sourceforge.net] On Behalf Of Kuang-Chun Cheng
> > Sent: Tuesday, November 13, 2007 10:33 AM
> > To: nagios-users at lists.sourceforge.net
> > Subject: [Nagios-users] nagios.log format
> >
> > Hi,
> >
> > I want to do post-analysis of nagios.log and save the filtered result
> to
> > DB.
> > The format look like this:
>
>
> >
> > Could someone tell me what's the fields means ?
> > What kind of message will be log into nagios.log.   Sometime I found
> > "SERVICE ALERT" message ...
> > any complete list existed for possible message ?  Thanks
>
> The only documentation I am aware of is the source code itself
> (nagios-src/base/logging.c). For anything that starts with MACRO_, you
> can find more information about that in the Macros documentation. --
>
> $ grep snprintf logging.c
>         snprintf(temp_buffer,sizeof(temp_buffer),"SERVICE ALERT:
> %s;%s;%s;%s;%s;%s\n",svc->host_name,svc->description,macro_x[MACRO_SERVI
> CESTATE],macro_x[MACRO_SERVICESTATETYPE],macro_x[MACRO_SERVICEATTEMPT],s
> vc->plugin_output);
>
> [timestamp] SERVICE ALERT:
> host_name;service_description;servicestate,servicestatetype,serviceattem
> pt;plugin_output
>
>         snprintf(temp_buffer,sizeof(temp_buffer),"HOST ALERT:
> %s;%s;%s;%s;%s\n",hst->name,macro_x[MACRO_HOSTSTATE],macro_x[MACRO_HOSTS
> TATETYPE],macro_x[MACRO_HOSTATTEMPT],hst->plugin_output);
>
> [timestamp] HOST ALERT:
> host_name,hoststate;hoststatetype;hostattempt;plugin_output
>
>                 snprintf(temp_buffer,sizeof(temp_buffer),"%s HOST STATE:
> %s;%s;%s;%s;%s\n",(type==INITIAL_STATES)?"INITIAL":"CURRENT",temp_host->
> name,macro_x[MACRO_HOSTSTATE],macro_x[MACRO_HOSTSTATETYPE],macro_x[MACRO
> _HOSTATTEMPT],temp_host->plugin_output);
>
> [timestamp] (INITIAL|CURRENT) HOST STATE:
> host_name;hoststate;hoststatetype;hostattempt;plugin_output
>
>                 snprintf(temp_buffer,sizeof(temp_buffer),"%s SERVICE
> STATE:
> %s;%s;%s;%s;%s;%s\n",(type==INITIAL_STATES)?"INITIAL":"CURRENT",temp_ser
> vice->host_name,temp_service->description,macro_x[MACRO_SERVICESTATE],ma
> cro_x[MACRO_SERVICESTATETYPE],macro_x[MACRO_SERVICEATTEMPT],temp_service
> ->plugin_output);
>
> [timestamp] (INITIAL|CURRENT) SERVICE STATE:
> host_name;service_description;servicestate;servicestatetype;serviceattem
> pt;plugin_output
>
>         snprintf(temp_buffer,sizeof(temp_buffer),"LOG ROTATION:
> %s\n",method_string);
>
> [timestamp] LOG ROTATION (daily|weekly|monthly, etc)
>
>         snprintf(temp_buffer,sizeof(temp_buffer),"LOG VERSION:
> %s\n",LOG_VERSION_2);
>
> [timestamp] LOG VERION: [log version string]
>
> Hth,
>
> --
> Marc
>
> -------------------------------------------------------------------------
> This SF.net email is sponsored by: Splunk Inc.
> Still grepping through log files to find problems?  Stop.
> Now Search log events and configuration files using AJAX and a browser.
> Download your FREE copy of Splunk now >> http://get.splunk.com/
> _______________________________________________
> Nagios-users mailing list
> Nagios-users at lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/nagios-users
> ::: Please include Nagios version, plugin version (-v) and OS when reporting any issue.
> ::: Messages without supporting info will risk being sent to /dev/null
>

-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems?  Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >> http://get.splunk.com/
_______________________________________________
Nagios-users mailing list
Nagios-users at lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/nagios-users
::: Please include Nagios version, plugin version (-v) and OS when reporting any issue. 
::: Messages without supporting info will risk being sent to /dev/null