[Summary view] [Print] [Text view]

   1  #! /bin/sh
   2  #
   3  # Log file pattern detector plugin for Nagios
   4  # Written by Ethan Galstad (nagios@nagios.org)
   5  # Last Modified: 07-31-1999
   6  #
   7  # Usage: ./check_log <log_file> <old_log_file> <pattern>
   8  #
   9  # Description:
  10  #
  11  # This plugin will scan a log file (specified by the <log_file> option)
  12  # for a specific pattern (specified by the <pattern> option).  Successive
  13  # calls to the plugin script will only report *new* pattern matches in the
  14  # log file, since an copy of the log file from the previous run is saved
  15  # to <old_log_file>.
  16  #
  17  # Output:
  18  #
  19  # On the first run of the plugin, it will return an OK state with a message
  20  # of "Log check data initialized".  On successive runs, it will return an OK
  21  # state if *no* pattern matches have been found in the *difference* between the
  22  # log file and the older copy of the log file.  If the plugin detects any 
  23  # pattern matches in the log diff, it will return a CRITICAL state and print
  24  # out a message is the following format: "(x) last_match", where "x" is the
  25  # total number of pattern matches found in the file and "last_match" is the
  26  # last entry in the log file which matches the pattern.
  27  #
  28  # Notes:
  29  #
  30  # If you use this plugin make sure to keep the following in mind:
  31  #
  32  #    1.  The "max_attempts" value for the service should be 1, as this
  33  #        will prevent Nagios from retrying the service check (the
  34  #        next time the check is run it will not produce the same results).
  35  #
  36  #    2.  The "notify_recovery" value for the service should be 0, so that
  37  #        Nagios does not notify you of "recoveries" for the check.  Since
  38  #        pattern matches in the log file will only be reported once and not
  39  #        the next time, there will always be "recoveries" for the service, even
  40  #        though recoveries really don't apply to this type of check.
  41  #
  42  #    3.  You *must* supply a different <old_file_log> for each service that
  43  #        you define to use this plugin script - even if the different services
  44  #        check the same <log_file> for pattern matches.  This is necessary
  45  #        because of the way the script operates.
  46  #
  47  # Examples:
  48  #
  49  # Check for login failures in the syslog...
  50  #
  51  #   check_log /var/log/messages ./check_log.badlogins.old "LOGIN FAILURE"
  52  #
  53  # Check for port scan alerts generated by Psionic's PortSentry software...
  54  #
  55  #   check_log /var/log/message ./check_log.portscan.old "attackalert"
  56  #
  57  
  58  # Paths to commands used in this script.  These
  59  # may have to be modified to match your system setup.
  60  
  61  PATH=""
  62  
  63  ECHO="/bin/echo"
  64  GREP="/bin/grep"
  65  DIFF="/bin/diff"
  66  TAIL="/bin/tail"
  67  CAT="/bin/cat"
  68  RM="/bin/rm"
  69  
  70  PROGNAME=`/bin/basename $0`
  71  PROGPATH=`echo $0 | /bin/sed -e 's,[\\/][^\\/][^\\/]*$,,'`
  72  REVISION=`echo '$Revision: 1.4 $' | /bin/sed -e 's/[^0-9.]//g'`
  73  
  74  . $PROGPATH/utils.sh
  75  
  76  print_usage() {
  77      echo "Usage: $PROGNAME -F logfile -O oldlog -q query"
  78      echo "Usage: $PROGNAME --help"
  79      echo "Usage: $PROGNAME --version"
  80  }
  81  
  82  print_help() {
  83      print_revision $PROGNAME $REVISION
  84      echo ""
  85      print_usage
  86      echo ""
  87      echo "Log file pattern detector plugin for Nagios"
  88      echo ""
  89      support
  90  }
  91  
  92  # Make sure the correct number of command line
  93  # arguments have been supplied
  94  
  95  if [ $# -lt 1 ]; then
  96      print_usage
  97      exit $STATE_UNKNOWN
  98  fi
  99  
 100  # Grab the command line arguments
 101  
 102  #logfile=$1
 103  #oldlog=$2
 104  #query=$3
 105  exitstatus=$STATE_WARNING #default
 106  while test -n "$1"; do
 107      case "$1" in
 108          --help)
 109              print_help
 110              exit $STATE_OK
 111              ;;
 112          -h)
 113              print_help
 114              exit $STATE_OK
 115              ;;
 116          --version)
 117              print_revision $PROGNAME $VERSION
 118              exit $STATE_OK
 119              ;;
 120          -V)
 121              print_revision $PROGNAME $VERSION
 122              exit $STATE_OK
 123              ;;
 124          --filename)
 125              logfile=$2
 126              shift
 127              ;;
 128          -F)
 129              logfile=$2
 130              shift
 131              ;;
 132          --oldlog)
 133              oldlog=$2
 134              shift
 135              ;;
 136          -O)
 137              oldlog=$2
 138              shift
 139              ;;
 140          --query)
 141              query=$2
 142              shift
 143              ;;
 144          -q)
 145              query=$2
 146              shift
 147              ;;
 148          -x)
 149              exitstatus=$2
 150              shift
 151              ;;
 152          --exitstatus)
 153              exitstatus=$2
 154              shift
 155              ;;
 156          *)
 157              echo "Unknown argument: $1"
 158              print_usage
 159              exit $STATE_UNKNOWN
 160              ;;
 161      esac
 162      shift
 163  done
 164  
 165  # If the source log file doesn't exist, exit
 166  
 167  if [ ! -e $logfile ]; then
 168      $ECHO "Log check error: Log file $logfile does not exist!\n"
 169      exit $STATE_UNKNOWN
 170  elif [ ! -r $logfile ] ; then
 171      $ECHO "Log check error: Log file $logfile is not readable!\n"
 172      exit $STATE_UNKNOWN
 173  fi
 174  
 175  # If the old log file doesn't exist, this must be the first time
 176  # we're running this test, so copy the original log file over to
 177  # the old diff file and exit
 178  
 179  if [ ! -e $oldlog ]; then
 180      $CAT $logfile > $oldlog
 181      $ECHO "Log check data initialized...\n"
 182      exit $STATE_OK
 183  fi
 184  
 185  # The old log file exists, so compare it to the original log now
 186  
 187  # The temporary file that the script should use while
 188  # processing the log file.
 189  if [ -x /bin/mktemp ]; then
 190      tempdiff=`/bin/mktemp /tmp/check_log.XXXXXXXXXX`
 191  else
 192      tempdiff=`/bin/date '+%H%M%S'`
 193      tempdiff="/tmp/check_log.$tempdiff}"
 194      /bin/touch $tempdiff
 195      chmod 600 $tempdiff
 196  fi
 197  
 198  $DIFF $logfile $oldlog > $tempdiff
 199  
 200  # Count the number of matching log entries we have
 201  count=`$GREP -c "$query" $tempdiff`
 202  
 203  # Get the last matching entry in the diff file
 204  lastentry=`$GREP "$query" $tempdiff | $TAIL --lines=1`
 205  
 206  $RM -f $tempdiff
 207  $CAT $logfile > $oldlog
 208  
 209  if [ "$count" = "0" ]; then # no matches, exit with no error
 210      $ECHO "Log check ok - 0 pattern matches found\n"
 211      exitstatus=$STATE_OK
 212  else # Print total matche count and the last entry we found
 213      $ECHO "($count) $lastentry"
 214      exitstatus=$STATE_CRITICAL
 215  fi
 216  
 217  exit $exitstatus