Logwathch monitoring not working

Troubleshooting
,
1

**CMK version:2.1.0
**OS version:RHEL7

We have configured logwatch monitoring as below. When i run check_mk_agent at client end, It shows up an Critical alert since the pattern matched “/var/log/oracle/alert_sync.log”.

/var/log/oracle/alert_sync.log
C REDALERT

Client output:
[[[/var/log/oracle/alert_sync.log]]]
C REDALERT | certdb.out | Thread: 1 |Archive log gap is 12 | Thu Nov 23 16:12:01 UTC 2023

But when i run on the server command “/usr/local/check_mk/bin/check_mk -v ” it says “Ok : No error message” for the “/var/log/oracle/alert_sync.log”.

What could be the issue.

2

With “mk_logwatch.py -d” you will get all matches of the whole file independent of last position in the state file.

mk_logwatch uses a different state file (logwatch.state.local) for local execution than for remote execution, which is why you won’t get allways the same results. Also keep in mind that mk_logwatch automatically jumps to the end of the file on the first run and only shows lines that have been added since the last run.