pkg-monitoring-plugins/plugins-scripts/check_log.sh

245 lines
7 KiB
Bash
Raw Normal View History

2013-11-26 22:53:19 +00:00
#!/bin/sh
#
2014-07-11 19:01:00 +00:00
# Log file pattern detector plugin for monitoring
2022-10-19 15:24:24 +00:00
# Written originally by Ethan Galstad (nagios@nagios.org)
2013-11-26 22:53:19 +00:00
#
# Usage: ./check_log <log_file> <old_log_file> <pattern>
#
# Description:
#
# This plugin will scan a log file (specified by the <log_file> option)
# for a specific pattern (specified by the <pattern> option). Successive
# calls to the plugin script will only report *new* pattern matches in the
# log file, since an copy of the log file from the previous run is saved
# to <old_log_file>.
#
# Output:
#
# On the first run of the plugin, it will return an OK state with a message
# of "Log check data initialized". On successive runs, it will return an OK
# state if *no* pattern matches have been found in the *difference* between the
2023-02-02 09:13:25 +00:00
# log file and the older copy of the log file. If the plugin detects any
2013-11-26 22:53:19 +00:00
# pattern matches in the log diff, it will return a CRITICAL state and print
# out a message is the following format: "(x) last_match", where "x" is the
# total number of pattern matches found in the file and "last_match" is the
# last entry in the log file which matches the pattern.
#
# Notes:
#
# If you use this plugin make sure to keep the following in mind:
#
2014-07-11 19:01:00 +00:00
# 1. The "max_attempts" value for the service should be 1, as this will
# prevent the monitoring system from retrying the service check (the
2013-11-26 22:53:19 +00:00
# next time the check is run it will not produce the same results).
#
2014-07-11 19:01:00 +00:00
# 2. The "notify_recovery" value for the service should be 0, so that the
# monitoring system does not notify you of "recoveries" for the check.
# Since pattern matches in the log file will only be reported once and
# not the next time, there will always be "recoveries" for the service,
# even though recoveries really don't apply to this type of check.
2013-11-26 22:53:19 +00:00
#
# 3. You *must* supply a different <old_file_log> for each service that
# you define to use this plugin script - even if the different services
# check the same <log_file> for pattern matches. This is necessary
# because of the way the script operates.
#
2022-10-19 15:24:24 +00:00
# 4. This plugin does NOT have an understanding of logrotation or similar
# mechanisms. Therefore bad timing could lead to missing events
#
#
2013-11-26 22:53:19 +00:00
# Examples:
#
# Check for login failures in the syslog...
#
# check_log /var/log/messages ./check_log.badlogins.old "LOGIN FAILURE"
#
# Check for port scan alerts generated by Psionic's PortSentry software...
#
# check_log /var/log/message ./check_log.portscan.old "attackalert"
#
# Paths to commands used in this script. These
# may have to be modified to match your system setup.
2014-07-11 19:01:00 +00:00
PATH="@TRUSTED_PATH@"
export PATH
2022-10-19 15:24:24 +00:00
PROGNAME=$(basename "$0")
PROGPATH=$(echo "$0" | sed -e 's,[\\/][^\\/][^\\/]*$,,')
2014-10-15 12:48:52 +00:00
REVISION="@NP_VERSION@"
2013-11-26 22:53:19 +00:00
2022-10-19 15:24:24 +00:00
. "$PROGPATH"/utils.sh
2013-11-26 22:53:19 +00:00
print_usage() {
echo "Usage: $PROGNAME -F logfile -O oldlog -q query"
echo "Usage: $PROGNAME --help"
echo "Usage: $PROGNAME --version"
2022-10-19 15:24:24 +00:00
echo ""
echo "Other parameters:"
echo " -a|--all : Print all matching lines"
2023-02-02 09:13:25 +00:00
echo " --exclude: Exclude a pattern (-p or -e also applies here when used)"
2022-10-19 15:24:24 +00:00
echo " -p|--perl-regex : Use perl style regular expressions in the query"
echo " -e|--extended-regex : Use extended style regular expressions in the query (not necessary for GNU grep)"
2013-11-26 22:53:19 +00:00
}
print_help() {
2022-10-19 15:24:24 +00:00
print_revision "$PROGNAME" "$REVISION"
2013-11-26 22:53:19 +00:00
echo ""
print_usage
echo ""
2014-07-11 19:01:00 +00:00
echo "Log file pattern detector plugin for monitoring"
2013-11-26 22:53:19 +00:00
echo ""
support
}
# Make sure the correct number of command line
# arguments have been supplied
if [ $# -lt 1 ]; then
print_usage
2022-10-19 15:24:24 +00:00
exit "$STATE_UNKNOWN"
2013-11-26 22:53:19 +00:00
fi
# Grab the command line arguments
exitstatus=$STATE_WARNING #default
while test -n "$1"; do
case "$1" in
2023-02-02 09:13:25 +00:00
-h | --help)
2013-11-26 22:53:19 +00:00
print_help
2022-10-19 15:24:24 +00:00
exit "$STATE_OK"
2013-11-26 22:53:19 +00:00
;;
2023-02-02 09:13:25 +00:00
-V | --version)
2022-10-19 15:24:24 +00:00
print_revision "$PROGNAME" "$REVISION"
exit "$STATE_OK"
2013-11-26 22:53:19 +00:00
;;
2023-02-02 09:13:25 +00:00
-F | --filename)
2013-11-26 22:53:19 +00:00
logfile=$2
2022-10-19 15:24:24 +00:00
shift 2
2013-11-26 22:53:19 +00:00
;;
2023-02-02 09:13:25 +00:00
-O | --oldlog)
2013-11-26 22:53:19 +00:00
oldlog=$2
2022-10-19 15:24:24 +00:00
shift 2
2013-11-26 22:53:19 +00:00
;;
2023-02-02 09:13:25 +00:00
-q | --query)
2013-11-26 22:53:19 +00:00
query=$2
2022-10-19 15:24:24 +00:00
shift 2
2013-11-26 22:53:19 +00:00
;;
2023-02-02 09:13:25 +00:00
--exclude)
exclude=$2
2022-10-19 15:24:24 +00:00
shift 2
2013-11-26 22:53:19 +00:00
;;
2023-02-02 09:13:25 +00:00
-x | --exitstatus)
2013-11-26 22:53:19 +00:00
exitstatus=$2
2022-10-19 15:24:24 +00:00
shift 2
2013-11-26 22:53:19 +00:00
;;
2023-02-02 09:13:25 +00:00
-e | --extended-regex)
2022-10-19 15:24:24 +00:00
ERE=1
shift
;;
2023-02-02 09:13:25 +00:00
-p | --perl-regex)
2022-10-19 15:24:24 +00:00
PRE=1
shift
;;
2023-02-02 09:13:25 +00:00
-a | --all)
2022-10-19 15:24:24 +00:00
ALL=1
2013-11-26 22:53:19 +00:00
shift
;;
*)
echo "Unknown argument: $1"
print_usage
2022-10-19 15:24:24 +00:00
exit "$STATE_UNKNOWN"
2013-11-26 22:53:19 +00:00
;;
esac
done
2022-10-19 15:24:24 +00:00
# Parameter sanity check
if [ $ERE ] && [ $PRE ] ; then
2023-02-02 09:13:25 +00:00
echo "Can not use extended and perl regex at the same time"
exit "$STATE_UNKNOWN"
2022-10-19 15:24:24 +00:00
fi
GREP="grep"
if [ $ERE ]; then
2023-02-02 09:13:25 +00:00
GREP="grep -E"
2022-10-19 15:24:24 +00:00
fi
if [ $PRE ]; then
2023-02-02 09:13:25 +00:00
GREP="grep -P"
2022-10-19 15:24:24 +00:00
fi
2013-11-26 22:53:19 +00:00
# If the source log file doesn't exist, exit
2022-10-19 15:24:24 +00:00
if [ ! -e "$logfile" ]; then
2014-07-11 19:01:00 +00:00
echo "Log check error: Log file $logfile does not exist!"
2022-10-19 15:24:24 +00:00
exit "$STATE_UNKNOWN"
elif [ ! -r "$logfile" ] ; then
2014-07-11 19:01:00 +00:00
echo "Log check error: Log file $logfile is not readable!"
2022-10-19 15:24:24 +00:00
exit "$STATE_UNKNOWN"
fi
# If no oldlog was given this can not work properly, abort then
if [ -z "$oldlog" ]; then
2023-02-02 09:13:25 +00:00
echo "Oldlog parameter is needed"
exit $STATE_UNKNOWN
2013-11-26 22:53:19 +00:00
fi
# If the old log file doesn't exist, this must be the first time
# we're running this test, so copy the original log file over to
# the old diff file and exit
2022-10-19 15:24:24 +00:00
if [ ! -e "$oldlog" ]; then
cat "$logfile" > "$oldlog"
2014-07-11 19:01:00 +00:00
echo "Log check data initialized..."
2022-10-19 15:24:24 +00:00
exit "$STATE_OK"
2013-11-26 22:53:19 +00:00
fi
# The old log file exists, so compare it to the original log now
# The temporary file that the script should use while
# processing the log file.
if [ -x /bin/mktemp ]; then
2022-10-19 15:24:24 +00:00
tempdiff=$(/bin/mktemp /tmp/check_log.XXXXXXXXXX)
2013-11-26 22:53:19 +00:00
else
2022-10-19 15:24:24 +00:00
tempdiff=$(/bin/date '+%H%M%S')
2013-11-26 22:53:19 +00:00
tempdiff="/tmp/check_log.${tempdiff}"
2022-10-19 15:24:24 +00:00
touch "$tempdiff"
chmod 600 "$tempdiff"
2013-11-26 22:53:19 +00:00
fi
2022-10-19 15:24:24 +00:00
diff "$logfile" "$oldlog" | grep -v "^>" > "$tempdiff"
2013-11-26 22:53:19 +00:00
2022-10-19 15:24:24 +00:00
if [ $ALL ]; then
2023-02-02 09:13:25 +00:00
# Get all matching entries in the diff file
if [ -n "$exclude" ]; then
entry=$($GREP "$query" "$tempdiff" | $GREP -v "$exclude")
count=$($GREP "$query" "$tempdiff" | $GREP -vc "$exclude")
else
entry=$($GREP "$query" "$tempdiff")
count=$($GREP -c "$query" "$tempdiff")
fi
2022-10-19 15:24:24 +00:00
else
2023-02-02 09:13:25 +00:00
# Get the last matching entry in the diff file
if [ -n "$exclude" ]; then
entry=$($GREP "$query" "$tempdiff" | $GREP -v "$exclude" | tail -1)
count=$($GREP "$query" "$tempdiff" | $GREP -vc "$exclude")
else
entry=$($GREP "$query" "$tempdiff" | tail -1)
count=$($GREP -c "$query" "$tempdiff")
fi
2022-10-19 15:24:24 +00:00
fi
2013-11-26 22:53:19 +00:00
2022-10-19 15:24:24 +00:00
rm -f "$tempdiff"
cat "$logfile" > "$oldlog"
2013-11-26 22:53:19 +00:00
if [ "$count" = "0" ]; then # no matches, exit with no error
2014-07-11 19:01:00 +00:00
echo "Log check ok - 0 pattern matches found"
2013-11-26 22:53:19 +00:00
exitstatus=$STATE_OK
2022-10-19 15:24:24 +00:00
else # Print total match count and the last entry we found
echo "($count) $entry"
2013-11-26 22:53:19 +00:00
exitstatus=$STATE_CRITICAL
fi
2022-10-19 15:24:24 +00:00
exit "$exitstatus"