Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

we are using check_log from the nagios-plugins to monitor logs, but the problem is that with big logfiles, even if we rotate logs hourly, the plugin causes significant spikes in memory and cpu usage.

That is because check_log is using diff to compare an old version of the log file with the current one.

Question is, without having to check the source of all check_log alternatives, is there any that doesn't use diff but for example follows the last checked linenumber and picks up checking from there?

share|improve this question
up vote 2 down vote accepted

check_logfiles plugin is what you're looking for:

When such a logfile rotation takes place, check_logfiles detects this and analyses the lines of the archived logfile, even if it's compressed.

share|improve this answer
Exaclty what I was looking for. – capsized Dec 9 '11 at 11:15

Checking log files on a scheduled basis is not a very efficient approach. While it would be posible to write a plugin which would would keep track of the position of the last offset in the file and handle rotations, a much simpler approach would be to run a filter daemon against the log files - there's lots of such tools available.

(you can still process the output of such tools using nagios for reporting / tracking purposes)

share|improve this answer
Imho running a daemon which prepares output for Nagios would add another layer of complexity (which also would need to be monitored). – capsized Dec 9 '11 at 11:19

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.