[Nagiosplug-devel] Log Status Checking

[Brian Milnes]

Folks,

 I've got some difficulty with the way(s) that I can get Nagios to
perform log status checking.
Can someone please validate or refute my current setup.

a) I need to check logs for the presence of every FATAL and ERROR.
b) check_log (and similar) will do this but

c) check_log keeps state by copying the entire log (into something
like X.log.old) which
     wastes time and money (if you're in the cloud and paying for IO)
d) when check_log returns other than OK, nagios rechecks and then
check_log thinks
     "I've read the whole log, remembered that I'm past that last
ERROR, so I'm OK now"
   and I don't get my page.
e) If I set the check's retry to 1 to work around this,  and I miss a
socket connection, for whatever reason
  then I'm going to get a night time page on my FATAL checker.

 For other monitoring systems I've built a C program that ran like this:
 check_log_smart -S <SEQUENCE_NUMBER> -L logfile -T statefile -P
APATTERN -P ANOTHERPATTERN
 where statefile= <BYTELASTREAD,LAST_SEQUENCE_NUMBER>.

 Can Nagios send along a sequence number? Does anyone have a smarter
NRPE plugin for this?

Thanks, Brian Milnes