1 files changed, 101 insertions, 67 deletions

diff --git a/plugins-scripts/check_log.sh b/plugins-scripts/check_log.sh
index d28c8d0..8ecdd31 100755
--- a/plugins-scripts/check_log.sh
+++ b/plugins-scripts/check_log.sh
@@ -1,8 +1,7 @@
 #!/bin/sh
 #
 # Log file pattern detector plugin for monitoring
-# Written by Ethan Galstad (nagios@nagios.org)
-# Last Modified: 07-31-1999
+# Written originally by Ethan Galstad (nagios@nagios.org)
 #
 # Usage: ./check_log <log_file> <old_log_file> <pattern>
 #
@@ -19,7 +18,7 @@
 # On the first run of the plugin, it will return an OK state with a message
 # of "Log check data initialized".  On successive runs, it will return an OK
 # state if *no* pattern matches have been found in the *difference* between the
-# log file and the older copy of the log file.  If the plugin detects any 
+# log file and the older copy of the log file.  If the plugin detects any
 # pattern matches in the log diff, it will return a CRITICAL state and print
 # out a message is the following format: "(x) last_match", where "x" is the
 # total number of pattern matches found in the file and "last_match" is the
@@ -44,6 +43,10 @@
 #        check the same <log_file> for pattern matches.  This is necessary
 #        because of the way the script operates.
 #
+#    4.  This plugin does NOT have an understanding of logrotation or similar
+#        mechanisms. Therefore bad timing could lead to missing events
+#
+#
 # Examples:
 #
 # Check for login failures in the syslog...
@@ -60,20 +63,26 @@
 
 PATH="@TRUSTED_PATH@"
 export PATH
-PROGNAME=`basename $0`
-PROGPATH=`echo $0 | sed -e 's,[\\/][^\\/][^\\/]*$,,'`
+PROGNAME=$(basename "$0")
+PROGPATH=$(echo "$0" | sed -e 's,[\\/][^\\/][^\\/]*$,,')
 REVISION="@NP_VERSION@"
 
-. $PROGPATH/utils.sh
+. "$PROGPATH"/utils.sh
 
 print_usage() {
     echo "Usage: $PROGNAME -F logfile -O oldlog -q query"
     echo "Usage: $PROGNAME --help"
     echo "Usage: $PROGNAME --version"
+        echo ""
+        echo "Other parameters:"
+        echo "  -a|--all : Print all matching lines"
+        echo "  --exclude: Exclude a pattern (-p or -e also applies here when used)"
+        echo "  -p|--perl-regex : Use perl style regular expressions in the query"
+        echo "  -e|--extended-regex : Use extended style regular expressions in the query (not necessary for GNU grep)"
 }
 
 print_help() {
-    print_revision $PROGNAME $REVISION
+    print_revision "$PROGNAME" "$REVISION"
     echo ""
     print_usage
     echo ""
@@ -87,81 +96,89 @@ print_help() {
 
 if [ $# -lt 1 ]; then
     print_usage
-    exit $STATE_UNKNOWN
+    exit "$STATE_UNKNOWN"
 fi
 
 # Grab the command line arguments
-
-#logfile=$1
-#oldlog=$2
-#query=$3
 exitstatus=$STATE_WARNING #default
 while test -n "$1"; do
     case "$1" in
-        --help)
+        -h | --help)
             print_help
-            exit $STATE_OK
+            exit "$STATE_UNKNOWN"
             ;;
-        -h)
-            print_help
-            exit $STATE_OK
-            ;;
-        --version)
-            print_revision $PROGNAME $REVISION
-            exit $STATE_OK
-            ;;
-        -V)
-            print_revision $PROGNAME $REVISION
-            exit $STATE_OK
-            ;;
-        --filename)
-            logfile=$2
-            shift
+        -V | --version)
+            print_revision "$PROGNAME" "$REVISION"
+            exit "$STATE_UNKNOWN"
             ;;
-        -F)
+        -F | --filename)
             logfile=$2
-            shift
+            shift 2
             ;;
-        --oldlog)
+        -O | --oldlog)
             oldlog=$2
-            shift
+            shift 2
             ;;
-        -O)
-            oldlog=$2
-            shift
-            ;;
-        --query)
+        -q | --query)
             query=$2
-            shift
+            shift 2
             ;;
-        -q)
-            query=$2
-            shift
+        --exclude)
+            exclude=$2
+            shift 2
             ;;
-        -x)
+        -x | --exitstatus)
             exitstatus=$2
+            shift 2
+            ;;
+        -e | --extended-regex)
+            ERE=1
             shift
             ;;
-        --exitstatus)
-            exitstatus=$2
+        -p | --perl-regex)
+            PRE=1
+            shift
+            ;;
+        -a | --all)
+            ALL=1
             shift
             ;;
         *)
             echo "Unknown argument: $1"
             print_usage
-            exit $STATE_UNKNOWN
+            exit "$STATE_UNKNOWN"
             ;;
     esac
-    shift
 done
 
+# Parameter sanity check
+if [ $ERE ] && [ $PRE ] ; then
+    echo "Can not use extended and perl regex at the same time"
+    exit "$STATE_UNKNOWN"
+fi
+
+GREP="grep"
+
+if [ $ERE ]; then
+    GREP="grep -E"
+fi
+
+if [ $PRE ]; then
+    GREP="grep -P"
+fi
+
 # If the source log file doesn't exist, exit
 
-if [ ! -e $logfile ]; then
+if [ ! -e "$logfile" ]; then
     echo "Log check error: Log file $logfile does not exist!"
-    exit $STATE_UNKNOWN
-elif [ ! -r $logfile ] ; then
+    exit "$STATE_UNKNOWN"
+elif [ ! -r "$logfile" ] ; then
     echo "Log check error: Log file $logfile is not readable!"
+    exit "$STATE_UNKNOWN"
+fi
+# If no oldlog was given this can not work properly, abort then
+if [ -z "$oldlog" ]; then
+    echo "Oldlog parameter is needed"
     exit $STATE_UNKNOWN
 fi
 
@@ -169,10 +186,10 @@ fi
 # we're running this test, so copy the original log file over to
 # the old diff file and exit
 
-if [ ! -e $oldlog ]; then
-    cat $logfile > $oldlog
+if [ ! -e "$oldlog" ]; then
+    cat "$logfile" > "$oldlog"
     echo "Log check data initialized..."
-    exit $STATE_OK
+    exit "$STATE_OK"
 fi
 
 # The old log file exists, so compare it to the original log now
@@ -180,31 +197,48 @@ fi
 # The temporary file that the script should use while
 # processing the log file.
 if [ -x /bin/mktemp ]; then
-    tempdiff=`/bin/mktemp /tmp/check_log.XXXXXXXXXX`
+
+    tempdiff=$(/bin/mktemp /tmp/check_log.XXXXXXXXXX)
 else
-    tempdiff=`/bin/date '+%H%M%S'`
+    tempdiff=$(/bin/date '+%H%M%S')
     tempdiff="/tmp/check_log.${tempdiff}"
-    touch $tempdiff
-    chmod 600 $tempdiff
+    touch "$tempdiff"
+    chmod 600 "$tempdiff"
 fi
 
-diff $logfile $oldlog | grep -v "^>" > $tempdiff
+diff "$logfile" "$oldlog" | grep -v "^>" > "$tempdiff"
+
 
-# Count the number of matching log entries we have
-count=`grep -c "$query" $tempdiff`
+if [ $ALL ]; then
+    # Get all matching entries in the diff file
+    if [ -n "$exclude" ]; then
+        entry=$($GREP "$query" "$tempdiff" | $GREP -v "$exclude")
+        count=$($GREP "$query" "$tempdiff" | $GREP -vc "$exclude")
+    else
+        entry=$($GREP "$query" "$tempdiff")
+        count=$($GREP -c "$query" "$tempdiff")
+    fi
 
-# Get the last matching entry in the diff file
-lastentry=`grep "$query" $tempdiff | tail -1`
+else
+    # Get the last matching entry in the diff file
+    if [ -n "$exclude" ]; then
+        entry=$($GREP "$query" "$tempdiff" | $GREP -v "$exclude" | tail -1)
+        count=$($GREP "$query" "$tempdiff" | $GREP -vc "$exclude")
+    else
+        entry=$($GREP "$query" "$tempdiff" | tail -1)
+        count=$($GREP -c "$query" "$tempdiff")
+    fi
+fi
 
-rm -f $tempdiff
-cat $logfile > $oldlog
+rm -f "$tempdiff"
+cat "$logfile" > "$oldlog"
 
 if [ "$count" = "0" ]; then # no matches, exit with no error
     echo "Log check ok - 0 pattern matches found"
     exitstatus=$STATE_OK
-else # Print total matche count and the last entry we found
-    echo "($count) $lastentry"
+else # Print total match count and the last entry we found
+    echo "($count) $entry"
     exitstatus=$STATE_CRITICAL
 fi
 
-exit $exitstatus
+exit "$exitstatus"