I’m simply trying to monitor a text/log file on one server in a linux environment from my main checkMK server in the same linux environment (i.e. /tmp/testfile.log on remote host). What I’d like to do is check the content of the last line of the log file and, based on a custom string output, have checkMK alert me to its status.
So, if the last line string value in the file = “Sync complete”, then status = OK
If the last line string value in the file = “Sync incomplete”, or really any other value, then status = CRITical or whatever.
Is there not a simple way to do this with checkMK?
A little backstory
I used to use a nagios plugin called “check_unison” which, in a nutshell, is a perl script which checks the last line of your unison log file, and then reports back a status based on that output. I have the nagios plugin; however, I’ve been struggling trying to use either the nagios plugin with CheckMK, or some other native option in CheckMK.
Any help would be greatly appreciated. I’m running version 2.2.0p9.
@mschlenker, thank you! The Nagios plugin via MRPE was precisely the answer to my problem. I was able to simply setup the /etc/check_mk/mrpe.cfg file with one line that had the following:
Name_of_new_service /path/to/nagios/plugin <flags used by the plugin>
That did it! Thank you again for your quick response/solution.
This follow-up is rather a note to my future self – your problem is adequately solved, yet others might have a more general task that is related.
Since tailing a large file basically reading the whole file from disk, this is often not suitable to do each minute in an agent plugin. So a smarter approach here would be using the logwatch plugin.
If logwatch is not flexible enough or transmits too much data to the Checkmk server, the alternative might be writing a small Python script that tails the file to observe…
And then in the callback function when a new line is detected, check it and write to a spool file:
Logwatch is only able to read new lines from a logfile. If the content of the file is always written from the start then this is not possible with logwatch.
That’s an important addition: Both – selfmade tail solutions and logwatch – can be only used for files that are appended, not for files that are entirely written.
This topic was automatically closed 365 days after the last reply. New replies are no longer allowed. Contact an admin if you think this should be re-opened.
The Nagios plugin via MRPE was precisely the answer to my problem. I was able to simply setup the /etc/check_mk/mrpe.cfg file with one line that had the following: