Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I know Nagios can monitor and alert on the content within a log file, but does anyone know of a plug-in, or other tool, that will monitor a log file for a particular string and then send the entire line in an email message where that match occured?

share|improve this question
    
It seems like this is doable with NRPE. What have you tried so far? –  uSlackr Feb 2 '12 at 19:20

6 Answers 6

up vote 1 down vote accepted

The stock check_log plugins is sort of... miserable; it uses 'diff' and processes the entire log, every time you run it, so it doesn't scale well. At all.

ConSol Labs maintains an excellent log checking plugin that does exactly what you want: http://exchange.nagios.org/directory/Plugins/Log-Files/check_logfiles/details

It is listed on Nagios Exchange, but here is the direct link to the English version: http://labs.consol.de/lang/en/nagios/check_logfiles/

You have to run this through NRPE, or check_via_ssh (+ ssh keys), obviously.

share|improve this answer
    
thanks - that looks helpful! –  af-at-work Feb 14 '12 at 16:20

@af-at-work: There is a tool for this:

"Tenshi is a log monitoring program, designed to watch one or more log files for lines matching user defined regular expressions and report on the matches. The regular expressions are assigned to queues which have an alert interval and a list of mail recipients."

Ubuntu package (Link), Debian package (Link).

share|improve this answer

If you can read the log file with a bash (or perl or python or etc.) script and search for the string (grep), sure. The script needs to set a non-zero return code and return the string. The script can reside on the server in question, and nagios can use the check_by_ssh command to run the script on the server.

share|improve this answer

Nagios Log Monitor

the above link might be the answer you're looking for. it can monitor any log file on local and remote hosts.

in the above link, the user is using a Nagios Log Monitoring tool called logrobot. you can visit the actual homepage to see more examples of how it works.

IF you wish to monitor a log, and see the details of the lines containing the string you specified, that logrobot tool can be run this way:

locally:

logrobot autofig /opt/jboss/jboss-as/server/production/log/server.log 60m 'INFO' '.' 1 2 -show

remotely:

NagiosLogMonitor remotehost logrobot autofig /opt/jboss/jboss-as/server/production/log/server.log 60m 'INFO' '.' 1 2 -show

When you run the above command, as was shown in the first link, you will be shown all fines found in the log file that contains the string 'INFO' you specified.

share|improve this answer

Why even involve Nagios in such a situation? This seems like over complication.

Why not just go to the server, write a small shell script to do what you want, execute it via a cron job. The scripting MUST contain in either case the logic to send email out.

share|improve this answer
    
Probably because he wants to centralize his monitoring? Perhaps because he wants this on 50 (or 500) servers? –  mfinni Feb 2 '12 at 20:55
    
If you use NRPE you are still going to have to touch all 50 or 500 servers for installation. You could put the scripting in a common place, and share it out to all systems. Using nagios does not centralize this type of operation, just complicates it. –  mdpc Feb 2 '12 at 20:58
    
"If you use NRPE you are still going to have to touch all 50 or 500 servers for installation." Answer: Chef. Or Puppet. –  cjc Feb 2 '12 at 21:02
    
Sure you can use that type of configuration as well for my suggestion as well. –  mdpc Feb 2 '12 at 21:04

Nagios now has a solution that integrates tightly with Nagios Core, XI, etc.

Nagios Log Server which can alert on any query on any log file on any system in your infrastructure.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.