Saturday, February 12, 2011

Nagios Log Monitoring(line by line) Plugin for linux

#!/bin/bash
#Purpose         : To monitor the log line by line
#Authors         : Ranjith Kumar R
#Date            : 29th March 2014
#Version         : V2.0

PROGNAME=`/bin/basename $0`
PROGPATH=`echo $0 | sed -e 's,[\\/][^\\/][^\\/]*$,,'`
REVISION="V1.0"
ECHO="/bin/echo"
STATE_UNKNOWN=3
STATE_OK=0
STATE_CRITICAL=2
TAIL="/usr/bin/tail"
MAIL="/bin/mail"
PRINT="/usr/bin/printf"
DATE=`/bin/date`
CONTACTEMAIL="ranjith@test.com"
print_usage() {
    echo "Usage: $PROGNAME -F LOGFILEPATH -q query -c critical count of string match"
    echo "Usage: $PROGNAME --help"
    echo "Usage: $PROGNAME --version"
}
print_help() {
    print_revision $PROGNAME $REVISION
    echo ""
    print_usage
    echo ""
    echo "Log file pattern detector plugin for Nagios"
    echo ""
    support
}
# Make sure the correct number of command line
# arguments have been supplied
if [ $# -lt 6 ]; then
    print_usage
    exit $STATE_UNKNOWN
fi
# Grab the command line arguments
#LOGFILEPATH=$1
#query=$2
exitstatus=$STATE_WARNING #default
while test -n "$1"; do
    case "$1" in
        --help)
            print_help
            exit $STATE_OK
            ;;
        -h)
            print_help
            exit $STATE_OK
            ;;
        --version)
            print_revision $PROGNAME $REVISION
            exit $STATE_OK
            ;;
        -V)
            print_revision $PROGNAME $REVISION
            exit $STATE_OK
            ;;
        --filename)
            LOGFILEPATH=$2
            shift
            ;;
        -F)
            LOGFILEPATH=$2
            shift
            ;;
        --query)
            query=$2
            shift
            ;;
        -q)
            query=$2
            shift
            ;;
        --critical)
            critical=$2
            shift
            ;;
        -c)
            critical=$2
            shift
            ;;
        -x)
            exitstatus=$2
            shift
            ;;
        --exitstatus)
            exitstatus=$2
            shift
            ;;
        *)
            echo "Unknown argument: $1"
            print_usage
            exit $STATE_UNKNOWN
            ;;
    esac
    shift
done
if [ -r $LOGFILEPATH ]; then

echo "$LOGFILEPATH has read permission" > /dev/null

else

echo "Nagios unable to read $LOGFILEPATH file, please check the file permission"

exitstatus=$STATE_CRITICAL
        exit $exitstatus

fi

query1=`echo $LOGFILEPATH |  awk -F"/" '{print $NF}'`.`echo $query | awk '{print $1}'`

                if [ -f "/usr/local/nagios/libexec/lastline.$query1" ]; then
                count=0
                else
                echo 0 > /usr/local/nagios/libexec/lastline.$query1
                fi
COUNT=0
LA="/usr/local/nagios/libexec/lastline.$query1"
LASTLINE=`cat /usr/local/nagios/libexec/lastline.$query1`
NEWLINE=`cat $LOGFILEPATH | wc -l`
if [ "$NEWLINE" -lt "$LASTLINE" ];then
echo 0 > /usr/local/nagios/libexec/lastline.$query1
fi
if [ "$NEWLINE" -gt "$LASTLINE" ];then
LINE=$(expr $NEWLINE - $LASTLINE)
echo $NEWLINE > $LA
COUNT=`$TAIL -$LINE $LOGFILEPATH | egrep -c "$query"`
MATCHLINE=`$TAIL -$LINE $LOGFILEPATH | egrep -i "$query"`
        if [ "$COUNT" -ge "$critical" ];then
        $ECHO -e "CRITICAL Matches per line for $query is $COUNT, please refer the below error log.\n$MATCHLINE\nLast Line is $LASTLINE and New Line is $NEWLINE ";echo '|' "count=$COUNT;;$critical"
$PRINT "%b" "***** CRITICAL *****\n\nNotification Type: CRITICAL\n\nCRITICAL Matches per line for $query is $COUNT, please refer the below error log.\n\n$MATCHLINE\n\nDate&Time: $DATE" | $MAIL -s "** CRITICAL Alert: $query **" $CONTACTEMAIL
        exitstatus=$STATE_CRITICAL
        exit $exitstatus
        fi
fi
if [ "$NEWLINE" -eq "$LASTLINE" ] || [ "$COUNT" -lt "$critical" ];then
   $ECHO "OK - $COUNT pattern matches found,Last Line is $LASTLINE and New Line is $NEWLINE";echo '|' "count=$COUNT;;$critical"
   exitstatus=$STATE_OK
   exit $exitstatus
else
   $ECHO "UNKNOWN, Last Line is $LASTLINE and New Line is $NEWLINE";echo '|' "count=$COUNT;;$critical"
   exitstatus=$STATE_UNKNOWN
   exit $exitstatus
fi
fi
--------------------------------------------------------------
e.g. ./check_log -F logfilepath(/var/log/messages) -q string(message) -c number of match
--------------------------------------------------------------------
It will through an error whenever there is a match.





2 comments:

  1. Thanks for the script it's working fine. I'm using this with NRPE. While running it on the server which one's mysql log file i'm monitoring showing correct output "CRITICAL Matches per line for ERROR is 3,Last Line is 5737 and New Line is 5740 | count=3;;1". But in Nagios it's showing, "OK - 0 pattern matches found,Last Line is 5740 and New Line is 0". And Nagios not showing critical warning when any maching pattern found. Any idea plz?

    ReplyDelete
  2. because when you ran script manually, last line number was 5737 and New line was 5740, 5740-5737=3, so there were three matches in last three lines.Nagios status was showing "OK - 0 pattern matches found, becz Last Line was 5740 and New Line also 5740. so 5740-5740=0, there were no lines were updated after 5740.

    ReplyDelete