summaryrefslogtreecommitdiffstats
path: root/plugins-scripts/check_log.sh
blob: 8ecdd3164d28337b5a068b69d876852ee8d03d74 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
#!/bin/sh
#
# Log file pattern detector plugin for monitoring
# Written originally by Ethan Galstad (nagios@nagios.org)
#
# Usage: ./check_log <log_file> <old_log_file> <pattern>
#
# Description:
#
# This plugin will scan a log file (specified by the <log_file> option)
# for a specific pattern (specified by the <pattern> option).  Successive
# calls to the plugin script will only report *new* pattern matches in the
# log file, since an copy of the log file from the previous run is saved
# to <old_log_file>.
#
# Output:
#
# On the first run of the plugin, it will return an OK state with a message
# of "Log check data initialized".  On successive runs, it will return an OK
# state if *no* pattern matches have been found in the *difference* between the
# log file and the older copy of the log file.  If the plugin detects any
# pattern matches in the log diff, it will return a CRITICAL state and print
# out a message is the following format: "(x) last_match", where "x" is the
# total number of pattern matches found in the file and "last_match" is the
# last entry in the log file which matches the pattern.
#
# Notes:
#
# If you use this plugin make sure to keep the following in mind:
#
#    1.  The "max_attempts" value for the service should be 1, as this will
#        prevent the monitoring system from retrying the service check (the
#        next time the check is run it will not produce the same results).
#
#    2.  The "notify_recovery" value for the service should be 0, so that the
#        monitoring system does not notify you of "recoveries" for the check.
#        Since pattern matches in the log file will only be reported once and
#        not the next time, there will always be "recoveries" for the service,
#        even though recoveries really don't apply to this type of check.
#
#    3.  You *must* supply a different <old_file_log> for each service that
#        you define to use this plugin script - even if the different services
#        check the same <log_file> for pattern matches.  This is necessary
#        because of the way the script operates.
#
#    4.  This plugin does NOT have an understanding of logrotation or similar
#        mechanisms. Therefore bad timing could lead to missing events
#
#
# Examples:
#
# Check for login failures in the syslog...
#
#   check_log /var/log/messages ./check_log.badlogins.old "LOGIN FAILURE"
#
# Check for port scan alerts generated by Psionic's PortSentry software...
#
#   check_log /var/log/message ./check_log.portscan.old "attackalert"
#

# Paths to commands used in this script.  These
# may have to be modified to match your system setup.

PATH="@TRUSTED_PATH@"
export PATH
PROGNAME=$(basename "$0")
PROGPATH=$(echo "$0" | sed -e 's,[\\/][^\\/][^\\/]*$,,')
REVISION="@NP_VERSION@"

. "$PROGPATH"/utils.sh

print_usage() {
    echo "Usage: $PROGNAME -F logfile -O oldlog -q query"
    echo "Usage: $PROGNAME --help"
    echo "Usage: $PROGNAME --version"
	echo ""
	echo "Other parameters:"
	echo "	-a|--all : Print all matching lines"
	echo "  --exclude: Exclude a pattern (-p or -e also applies here when used)"
	echo "	-p|--perl-regex : Use perl style regular expressions in the query"
	echo "	-e|--extended-regex : Use extended style regular expressions in the query (not necessary for GNU grep)"
}

print_help() {
    print_revision "$PROGNAME" "$REVISION"
    echo ""
    print_usage
    echo ""
    echo "Log file pattern detector plugin for monitoring"
    echo ""
    support
}

# Make sure the correct number of command line
# arguments have been supplied

if [ $# -lt 1 ]; then
    print_usage
    exit "$STATE_UNKNOWN"
fi

# Grab the command line arguments
exitstatus=$STATE_WARNING #default
while test -n "$1"; do
    case "$1" in
        -h | --help)
            print_help
            exit "$STATE_UNKNOWN"
            ;;
        -V | --version)
            print_revision "$PROGNAME" "$REVISION"
            exit "$STATE_UNKNOWN"
            ;;
        -F | --filename)
            logfile=$2
            shift 2
            ;;
        -O | --oldlog)
            oldlog=$2
            shift 2
            ;;
        -q | --query)
            query=$2
            shift 2
            ;;
        --exclude)
            exclude=$2
            shift 2
            ;;
        -x | --exitstatus)
            exitstatus=$2
            shift 2
            ;;
        -e | --extended-regex)
            ERE=1
            shift
            ;;
        -p | --perl-regex)
            PRE=1
            shift
            ;;
        -a | --all)
            ALL=1
            shift
            ;;
        *)
            echo "Unknown argument: $1"
            print_usage
            exit "$STATE_UNKNOWN"
            ;;
    esac
done

# Parameter sanity check
if [ $ERE ] && [ $PRE ] ; then
    echo "Can not use extended and perl regex at the same time"
    exit "$STATE_UNKNOWN"
fi

GREP="grep"

if [ $ERE ]; then
    GREP="grep -E"
fi

if [ $PRE ]; then
    GREP="grep -P"
fi

# If the source log file doesn't exist, exit

if [ ! -e "$logfile" ]; then
    echo "Log check error: Log file $logfile does not exist!"
    exit "$STATE_UNKNOWN"
elif [ ! -r "$logfile" ] ; then
    echo "Log check error: Log file $logfile is not readable!"
    exit "$STATE_UNKNOWN"
fi
# If no oldlog was given this can not work properly, abort then
if [ -z "$oldlog" ]; then
    echo "Oldlog parameter is needed"
    exit $STATE_UNKNOWN
fi

# If the old log file doesn't exist, this must be the first time
# we're running this test, so copy the original log file over to
# the old diff file and exit

if [ ! -e "$oldlog" ]; then
    cat "$logfile" > "$oldlog"
    echo "Log check data initialized..."
    exit "$STATE_OK"
fi

# The old log file exists, so compare it to the original log now

# The temporary file that the script should use while
# processing the log file.
if [ -x /bin/mktemp ]; then

    tempdiff=$(/bin/mktemp /tmp/check_log.XXXXXXXXXX)
else
    tempdiff=$(/bin/date '+%H%M%S')
    tempdiff="/tmp/check_log.${tempdiff}"
    touch "$tempdiff"
    chmod 600 "$tempdiff"
fi

diff "$logfile" "$oldlog" | grep -v "^>" > "$tempdiff"


if [ $ALL ]; then
    # Get all matching entries in the diff file
    if [ -n "$exclude" ]; then
        entry=$($GREP "$query" "$tempdiff" | $GREP -v "$exclude")
        count=$($GREP "$query" "$tempdiff" | $GREP -vc "$exclude")
    else
        entry=$($GREP "$query" "$tempdiff")
        count=$($GREP -c "$query" "$tempdiff")
    fi

else
    # Get the last matching entry in the diff file
    if [ -n "$exclude" ]; then
        entry=$($GREP "$query" "$tempdiff" | $GREP -v "$exclude" | tail -1)
        count=$($GREP "$query" "$tempdiff" | $GREP -vc "$exclude")
    else
        entry=$($GREP "$query" "$tempdiff" | tail -1)
        count=$($GREP -c "$query" "$tempdiff")
    fi
fi

rm -f "$tempdiff"
cat "$logfile" > "$oldlog"

if [ "$count" = "0" ]; then # no matches, exit with no error
    echo "Log check ok - 0 pattern matches found"
    exitstatus=$STATE_OK
else # Print total match count and the last entry we found
    echo "($count) $entry"
    exitstatus=$STATE_CRITICAL
fi

exit "$exitstatus"