[Check_mk (english)] Check_mk-logwatch plugin doesn't work

Archive checkmk-en
1

Hi Guys,
actually I am running OMD 1.20 installed by RPM on Centos 7 and epel 7. The scenario is:

1 OMD server and Check_MK

1 Remote server to be monitored

In both the servers the agent is installed and running. In both the servers the /etc/check_mk/logwatch.conf file is very easy:

/misc/java/host1/exceptions.log

C Error

I expect to see every output after Error: in Critical Alert, but nothing happen. Run the command /usr/lib/check_mk_agent/plugins/mk_logwatch on the host give me this output:

<<>>

[[[/misc/java/host1/exceptions.log]]]

[[[C:missing]]]

[[[Error:missing]]]

Grepping the log file of course I have a lot of Error. Thanks for any help.

Antonio

2

Try adding a new entry to the logfile.
mk_logwatch keeps a pointer to the file so it doesn’t alarm on any
old entries.
(I vaguely seem to remember the first time it runs it doesn’t
generate any alerts to keep
�from clogging up the system with old log entries.) In any case,
it’s a fairly simple script
so take a look at the code to see exactly what it does.

···

On 5/16/2015 1:10 PM, Antonio Esposito
wrote:

Hi Guys,
actually I am running OMD 1.20 installed by RPM on Centos 7
and epel 7. The scenario is:

1 OMD server and Check_MK

1 Remote server to be monitored

      In both the servers the agent is installed and running. In

both the servers the /etc/check_mk/logwatch.conf file is very
easy:

�/misc/java/host1/exceptions.log

C Error

      I expect to see every output after Error: in Critical

Alert, but nothing happen. Run the command
/usr/lib/check_mk_agent/plugins/mk_logwatch on the host give
me this output:

<<>>

[[[/misc/java/host1/exceptions.log]]]

[[[C:missing]]]

[[[Error:missing]]]

      Grepping the log file of course I have a lot of Error.

Thanks for any help.

Antonio




_______________________________________________
checkmk-en mailing list
We�ll meet in Munich for the 2nd Check_MK Conference!
Book your place now and be part of it.
October 18th-20th, 2015

checkmk-en@lists.mathias-kettner.dehttp://lists.mathias-kettner.de/mailman/listinfo/checkmk-enhttp://mathias-kettner.de/conference

3

Hi Antonio,

Your problem is in the conference file. You must prefix the pattern line with a whitespace (tab or space), only the lines with filenames and paths may start at beginning of the line.

HTH,
Marcel

···

Jam Mulch spammagnet10@gmail.com schrieb am Sa., 16. Mai 2015 19:30:

Try adding a new entry to the logfile.

mk_logwatch keeps a pointer to the file so it doesn't alarm on any

old entries.

(I vaguely seem to remember the first time it runs it doesn't

generate any alerts to keep

 from clogging up the system with old log entries.) In any case,

it’s a fairly simple script

so take a look at the code to see exactly what it does.

  On 5/16/2015 1:10 PM, Antonio Esposito > wrote:

Hi Guys,
actually I am running OMD 1.20 installed by RPM on Centos 7
and epel 7. The scenario is:

1 OMD server and Check_MK

1 Remote server to be monitored

      In both the servers the agent is installed and running. In

both the servers the /etc/check_mk/logwatch.conf file is very
easy:

/misc/java/host1/exceptions.log

C Error

      I expect to see every output after Error: in Critical

Alert, but nothing happen. Run the command
/usr/lib/check_mk_agent/plugins/mk_logwatch on the host give
me this output:

<<>>

[[[/misc/java/host1/exceptions.log]]]

[[[C:missing]]]

[[[Error:missing]]]

      Grepping the log file of course I have a lot of Error.

Thanks for any help.

Antonio

_______________________________________________
checkmk-en mailing list
checkmk-en@lists.mathias-kettner.de
[http://lists.mathias-kettner.de/mailman/listinfo/checkmk-en](http://lists.mathias-kettner.de/mailman/listinfo/checkmk-en)

We’ll meet in Munich for the 2nd Check_MK Conference!
Book your place now and be part of it.
October 18th-20th, 2015
[http://mathias-kettner.de/conference](http://mathias-kettner.de/conference)

checkmk-en mailing list

checkmk-en@lists.mathias-kettner.de

http://lists.mathias-kettner.de/mailman/listinfo/checkmk-en

We’ll meet in Munich for the 2nd Check_MK Conference!

Book your place now and be part of it.

October 18th-20th, 2015

http://mathias-kettner.de/conference

4

Good catch! I’d forgotten about the indentation. Just for
comparison, here’s a portion of one of my
/etc/check_mk/logwatch.cfg files.

/var/log/syslog /var/log/kern.log
� C panic
� C Oops
� W generic protection rip
� W .*Unrecovered read error - auto reallocate failed
···

checkmk-en@lists.mathias-kettner.dehttp://lists.mathias-kettner.de/mailman/listinfo/checkmk-enhttp://mathias-kettner.de/conference

5

I'm having some problems with the mk_inventory plugin from Check_MK 1.2.6p1
on certain Solaris clients.

Case 1: Sun Fire T1000 without sneep installed.
This is a strange one. Most of the commands hang sneep,prtdiag,prtpicl,pkginfo
and stay around so the first one to hang would up the process count and eventually
hang the box. Fortunately I caught it before the mk_inventory processes topped 100.
This *may* be due to the box being locked down pretty tight for security, but is
troubling. I was thinking maybe adding waitmax to the commands so they could
time out before the next run and keep the box from running out of resources.
For now, I've just commented out everything except the uname section to keep
from having to acknowledge the inventory check forever.

Case 2: Supermicro (not sure of the model)
I've got two of these. The inventory check comes back with a warning of 'index out of range'.
It appears to be something in the 'prtdiag -v' output. Other than the two digit year in the
date, I don't see anything unusual compared to other systems, but I haven't tried to locate
the service side code to see how the output is parsed yet. I know it's the prtdiag -v output
because when I commented out that part of mk_inventory the error went away. While
troubleshooting, I commented out the prtdiag -v call and substituted a cat of a prtdiag
output from a working system and it worked as well. Now I can't seem to reproduce
the error...I'm guessing the output is cached somewhere...I tried deleting the
/var/lib/check_mk_agent/mk_inventory.last. file and forcing an inventory check, but still
not able to get the error to recur. Here's the original output of 'prtdiag -v' that caused
the problem:

System Configuration: Supermicro H8DG6/H8DGi
BIOS Configuration: American Megatrends Inc. 1.0b 03/23/11
BMC Configuration: IPMI 2.0 (KCS: Keyboard Controller Style)

==== Processor Sockets ====================================

Version Location Tag
-------------------------------- --------------------------
D1 CPU 1
D1 CPU 2

==== Memory Device Sockets ================================

Type Status Set Device Locator Bank Locator
------- ------ --- ------------------- --------------------
unknown empty 0 P1_DIMM1B BANK0
DDR3 in use 0 P1_DIMM1A BANK1
unknown empty 0 P1_DIMM2B BANK2
unknown empty 0 P1_DIMM2A BANK3
unknown empty 0 P1_DIMM3B BANK4
DDR3 in use 0 P1_DIMM3A BANK5
unknown empty 0 P1_DIMM4B BANK6
unknown empty 0 P1_DIMM4A BANK7
unknown empty 0 P2_DIMM1B BANK8
DDR3 in use 0 P2_DIMM1A BANK9
unknown empty 0 P2_DIMM2B BANK10
unknown empty 0 P2_DIMM2A BANK11
unknown empty 0 P2_DIMM3B BANK12
DDR3 in use 0 P2_DIMM3A BANK13
unknown empty 0 P2_DIMM4B BANK14
unknown empty 0 P2_DIMM4A BANK15

==== On-Board Devices =====================================

==== Upgradeable Slots ====================================

ID Status Type Description
--- --------- ---------------- ----------------------------
1 available PCI Express PCIE1
2 available PCI Express PCIE2

6

Hi Antonio,

Just do it like Jam wrote.

Regards,
Marcel

···

Jam Mulch spammagnet10@gmail.com schrieb am Sa., 16. Mai 2015 20:51:

Good catch! I'd forgotten about the indentation. Just for

comparison, here’s a portion of one of my

/etc/check_mk/logwatch.cfg files.



/var/log/syslog /var/log/kern.log

  C panic

  C Oops

  W generic protection rip

  W .*Unrecovered read error - auto reallocate failed

On 5/16/2015 1:37 PM, Marcel Schulte wrote:

    Hi Antonio,

    Your problem is in the conference file. You must

prefix the pattern line with a whitespace (tab or space), only
the lines with filenames and paths may start at beginning of the
line.

HTH,
Marcel

Jam Mulch <spammagnet10@gmail.com >
schrieb am Sa., 16. Mai 2015 19:30:

        Try adding a new entry

to the logfile.

        mk_logwatch keeps a pointer to the file so it doesn't alarm

on any old entries.

        (I vaguely seem to remember the first time it runs it

doesn’t generate any alerts to keep

         from clogging up the system with old log entries.) In any

case, it’s a fairly simple script

        so take a look at the code to see exactly what it does.

On 5/16/2015 1:10 PM, Antonio Esposito wrote:

Hi Guys,
actually I am running OMD 1.20 installed by RPM on
Centos 7 and epel 7. The scenario is:

1 OMD server and Check_MK

1 Remote server to be monitored

              In both the servers the agent is installed and

running. In both the servers the
/etc/check_mk/logwatch.conf file is very easy:

/misc/java/host1/exceptions.log

C Error

              I expect to see every output after Error: in

Critical Alert, but nothing happen. Run the command
/usr/lib/check_mk_agent/plugins/mk_logwatch on the
host give me this output:

<<>>

[[[/misc/java/host1/exceptions.log]]]

[[[C:missing]]]

[[[Error:missing]]]

              Grepping the log file of course I have a lot of

Error. Thanks for any help.

Antonio

_______________________________________________
checkmk-en mailing list
checkmk-en@lists.mathias-kettner.de
[http://lists.mathias-kettner.de/mailman/listinfo/checkmk-en](http://lists.mathias-kettner.de/mailman/listinfo/checkmk-en)

We’ll meet in Munich for the 2nd Check_MK Conference!
Book your place now and be part of it.
October 18th-20th, 2015
[http://mathias-kettner.de/conference](http://mathias-kettner.de/conference)

      checkmk-en mailing list

      checkmk-en@lists.mathias-kettner.de

      [http://lists.mathias-kettner.de/mailman/listinfo/checkmk-en](http://lists.mathias-kettner.de/mailman/listinfo/checkmk-en)



      We’ll meet in Munich for the 2nd Check_MK Conference!

      Book your place now and be part of it.

      October 18th-20th, 2015

      [http://mathias-kettner.de/conference](http://mathias-kettner.de/conference)

_______________________________________________
checkmk-en mailing list
checkmk-en@lists.mathias-kettner.de
[http://lists.mathias-kettner.de/mailman/listinfo/checkmk-en](http://lists.mathias-kettner.de/mailman/listinfo/checkmk-en)

We’ll meet in Munich for the 2nd Check_MK Conference!
Book your place now and be part of it.
October 18th-20th, 2015
[http://mathias-kettner.de/conference](http://mathias-kettner.de/conference)

checkmk-en mailing list

checkmk-en@lists.mathias-kettner.de

http://lists.mathias-kettner.de/mailman/listinfo/checkmk-en

We’ll meet in Munich for the 2nd Check_MK Conference!

Book your place now and be part of it.

October 18th-20th, 2015

http://mathias-kettner.de/conference