<html> <head> <meta content="text/html; charset=ISO-8859-1" http-equiv="Content-Type"> </head> <body bgcolor="#FFFFFF" text="#000000"> Hi, If you ran your tests with an other user than the one NRPE is using on your server, may be he can't overwrite your /tmp/messages file and trigger a CRITICAL state (I see in your tests you are logged in as root). Marc-André On 11/04/2011 04:53 AM, Brandstaetter, Sigmund wrote: <blockquote cite="mid:B4A27DE8154689438A96BD62CD133D9427AE6BBB@G4W3215.americas.hpqcorp.net" type="cite"> <pre wrap="">Hi Guys, First of all, hello, since this is my first post to the list. I hope some of you will be able to give me some input on my problem. I have a Nagios Server to monitor some Hosts (Nagios 3.3.1) using NRPE and SNMP Checks I wanna check a logfile for eg. the string error. The check works fine when I run it locally, meaning, after the check detects the pattern, it creates an alert, then, on the next check, if no new pattern was detected, it will return OK. When I now run the check via nrpe from the nagios server, it will also detect the pattern, but it will also come back with CRITICAL on each check thereafter even if there have been no additional occurrences of it. This is what the corresponding line in the nrpe.cfg on the remote host looks like for this check: command[check_messages]=/usr/local/nagios/libexec/check_log -F /var/log/messages -O /tmp/messages -q "error" Note that all other checks work fine, so nrpe works fine. EG: [root@xx libexec]# ./check_nrpe -H xxxxxx -c check_messages (2) < error [root@xx libexec]# ./check_nrpe -H xxxxxx -c check_messages (2) < error [root@xx libexec]# ./check_nrpe -H xxxxxx -c check_messages (2) < error [root@xx libexec]# ./check_nrpe -H xxxxxx -c check_messages (2) < error [root@xx libexec]# ./check_nrpe -H xxxxxx -c check_messages (2) < error But locally on the host, using the same check_log with the same parameters that I have in my nrpe.cfg it works: [root@xx libexec]# ./check_log -F /var/log/messages -O /tmp/messages -q "error" (13) < Nov 4 10:49:57 tuphlog1 nagios: SERVICE NOTIFICATION: nagiosadmin;tuphweb2;LOG - Authentication Errors;UNKNOWN;notify-service-by-email;Log check error: xxxx [root@xx libexec]# ./check_log -F /var/log/messages -O /tmp/messages -q "error" Log check ok - 0 pattern matches found Any Idea what could be the problem? Cheers Sigmund </pre> <fieldset class="mimeAttachmentHeader"></fieldset> <pre wrap="">------------------------------------------------------------------------------ RSA(R) Conference 2012 Save $700 by Nov 18 Register now <a class="moz-txt-link-freetext" href="http://p.sf.net/sfu/rsa-sfdev2dev1">http://p.sf.net/sfu/rsa-sfdev2dev1</a></pre> <fieldset class="mimeAttachmentHeader"></fieldset> <pre wrap="">_______________________________________________ Nagios-users mailing list <a class="moz-txt-link-abbreviated" href="mailto:Nagios-users@lists.sourceforge.net">Nagios-users@lists.sourceforge.net</a> <a class="moz-txt-link-freetext" href="https://lists.sourceforge.net/lists/listinfo/nagios-users">https://lists.sourceforge.net/lists/listinfo/nagios-users</a> ::: Please include Nagios version, plugin version (-v) and OS when reporting any issue. ::: Messages without supporting info will risk being sent to /dev/null</pre> </blockquote> </body> </html>