Monitoring logfiles in windows without having to bake agents

Hello,

I’m trying to setup logfile monitoring to monitor for example C:\Users\wtv\test.log to trap everytime a certain string appears. I have followed Episode 22: Monitoring logfiles with Checkmk - YouTube but it uses agent baking. We have a lot of clients using our CheckMK instances and some of them won’t be able to install or redeploy the agents. We would like to be able to only modify the logwatch.cfg file and create a new rule in CheckMK without having to bake. Is this possible? Have you guys had any success doing it this way? I can’t get it to work, even if I copy the files after baking and deploy them on a second server.

Thanks for the help.

I managed to install the python-3.8 module, configure the logwatch.cfg and import the mk_logwatch.py into my server. When I test the plugin, I see the logfile, but when i telnet on port 6556, the logwatch section for files isn’t there.

If you have the actual 2.1 version then you are a victim of a “nice” mk_logwatch bug on Windows. You need to replace the mk_logwatch.py with an older version like 2.1.0p9.
Only the mk_logwatch.py needs to be replaced.

Inside this thread to can find some more information if needed.
It is mostly in German but at the end is also a little bit English.

We are actually running the 2.0.0p15 version, same for the mk_logwatch.py

I have just found that when I do C:\Program Files (x86)\checkmk\service>check_mk_agent.exe check -self a line appears when the plugin works:
A Module changes command line of the plugin ‘C:\ProgramData\checkmk\agent\modules\python-3.8.venv\Scripts\python.exe C:\ProgramData\checkmk\agent\plugins\mk_logwatch.checkmk.py’
But it doesn’t appear on my other machine. I assume it’s because MK didn’t install with baking the python-3.8 module, but it is installed. I ran the post postinstall.cmd after extracting the files from the zip.

Do you use the option ‘CLUSTER’ in your logwatch.cfg?

No, we don’t use this option.

This topic was automatically closed 365 days after the last reply. New replies are no longer allowed. Contact an admin if you think this should be re-opened.