How is it possible to monitor by using logwatch date logs with names like “server-2025-03-13.log” only the logs from today?
By using “*” all files are presented as Service but I need just the actual date log to monitor and I need only one service in the host GUI.
But how is that possible by using which detection code in the rule for the agent bakery?
Are there variable available for the date (year, month, day) if so, how is the writing?
Or how to monitor just the newest log file?
Please let me know.
Thanks
Best regards
JP
Output of “cmk --debug -vvn hostname”: (If it is a problem with checks or plugins)
thanks but we can’t change anything at the server just looking at the logs.
In 2025 there must be an solution to handle such behavior without changing, just using the monitoring tool Checkmk. But how?
According to docs:
Only glob pattern or regex is supported
But both are clueless about date time, unless you supply a string to compare it by. So that kind of feels manipulation of the config after deploying. With raw, what I’m running, there’s no Bakery, so it would be script on server doing the manipulation.
Regarding Bakery following is mentioned in docs:
The default setting Deploy the Logwatch plugin and its configuration should normally be left as it is. However, if you want or need to transfer the configuration file logwatch.cfg to the host in a different way, the Deploy the Logwatch plugin without configuration
option is still available here.
Maybe a manipulated Logwatch configuration can be pushed daily to the server?
I think what Paulo is trying to tell you is that this might not be a problem at all. If you have logs in your directory (for example: /log/25-03-01.log, /log/25-03-02.log, etc.) and you configure checkmk to check for logs in /log/*.log, then checkmk will monitor those files for changes. As long as only one file is modified (usually, this should be only today’s log file), cmk will process just those changes and ignore the old files. So no need to provide the exact filename… (Have a look at https://docs.checkmk.com/latest/en/monitoring_logfiles.html.) Maybe this already satisfies your needs…
Hi Daniel
ah ok, but then we’ve further to do for a simple task for Checkmk.
Further I don’t need the services by each log only one single log service for the current log of the current day.
Further the to do is scripting which is not the prefered way to do.
Hence scripting is not a solution for the simple task and changing something at the target host is not possible. So how is the solution in 2025 by using just the Checkmk GUI to solve the little task?
There is no need to do any scripting. Of course you have to configure your log configuration. If you want to use the GUI “for everything “ (especially the agent config), you should check out the enterprise version of Checkmk. For extended Log features, please have a look at the “Event console “.
Hello Paulo
Thanks but I think it is just not possible with Checkmk.
The customer wants to have just need one service, based on the newest logfile name, nothing more. The other logs are not relevant to handle.
The event console makes the task too complicated and will not show the current file.
Since log files have existed, they have been rotated or have a date in their name. However, from a customer/application point of view, it is always the same log file.
As a customer, I would expect mk_logwacht to recognise that a log has been rotated, and for the log lines of the old and new log files to be shown under the same service name in Checkmk. Instead, Checkmk creates a new service for each log file, which needs to be discovered and enabled first (if I’m not mistaken, all log lines are lost until the new service is enabled).
We have repeatedly discussed this issue with Check in recent years, but they have always made it clear that they have no intention of dealing with it. Maybe they can be convinced if you all vote:
As a workaround you use a cronjob to set a soft link to the current log file so that the log check always sees the same file name.
If someone is looking for an alternative that can handle rotated log files excellently, they should take a look at the check_logfiles plugin from Consol Labs, which could be integrated as an MRPE check: https://labs.consol.de/de/nagios/check_logfiles/index.html
Hello Lars
this is/was exactly my assumption.
The problem is as old as software is produced but not handled. hence we’ve a lot of the same tickets in the forum which I searched.
I will vote! but my experience about CMK feature requests is that they will not be implemented.
We spend weeks in butting informations in it but 90% are closed with Info like yours: “Not planned”.
Problem from customers are not seen.
Thanks
You can forward everything to Event Console and then use the following ruleset to achieve what you need creating a service using the desired events from Event Console:
This topic was automatically closed 365 days after the last reply. New replies are no longer allowed. Contact an admin if you think this should be re-opened.
