Log parser

Service Monitoring
1

Hi

Requirements

  • self custom python script
  • Add a short revision version e.g. v0.1
  • Tested with specific versions
  • Icinga 2 v2.8.x
  • Icinga Web 2 v2.5.x
  • English only

Introduction

python script to parse the logs and alert for a given string as input with a given log file. The script is Configured and it is working fine in identifying critical and warning parsing for the strings in the log file but color code is not working with the alert. it shows the critical alert in green color and not turning to RED.

Requirements

  • Icinga 2 v2.8.x
  • Icinga Web 2 v2.5.x

Linux

centos 7

2

And when you execute the script on CLI and type echo $? directly after the script, it says what?

3

when the /te.log last line is ts-have-problem it alerts critical and when the last line is TS-Complete then is saying ok

/usr/lib64/nagios/plugins/check_log.py --file=/home/ts/te.log --errorMsg=“ts-have-problem” --successMsg=“TS-Complete”
ALERT: CRITICAL

/usr/lib64/nagios/plugins//check_log.py --file=/home/ts/te.log --errorMsg=“ts-have-problem” --successMsg=“TS-Complete”
ALERT: OK

4

./check_log.py echo $
usage: check_log.py [-h] [–file FILE] [–errorMsg ERRORMSG]
[–successMsg SUCCESSMSG]
check_log.py: error: unrecognized arguments: echo $

5

As Marcus already have written, try your plugin first:

And run then immediately:

echo $?

The result have to be 2 but as you describe it will be 0. If so, your plugin script needs to be modified. For this example you need something like:

exit(2)

6

Please remember to always run your plugins with the same user as Icinga is running. e.g.

sudo -u icinga /usr/lib64/nagios/plugins/test_plugin

This way you not only make sure that Icinga is actually allowed to run the plugin when configured as a check, you avoid problems with temporary and log files, too.

Welcome to the wonderful world of Icinga, by the way.

1 Like
7

root@test: ~# /usr/lib64/nagios/plugins/mobi/check_log.py --file=/var/tmp/te.log --errorMsg=“ts-have-problem” --successMsg=“TS-Complete”
ALERT: CRITICAL
root@test: ~# echo $?
0

8

And there is the reason

9

Thx guys got it fixed with the right exit code and able to see the color codes but further developed the script to parse a API which gives NRPE: Unable to read output in the icinga board .

any thoughts here …

wrote a python script to monitor and parse the API out The script is Configured and it is working fine in the command line but on the Icinga board it shows as unknow.?

/usr/lib64/nagios/plugins/mobi/check_log_time.py --process=“POLICY_UPDATES” --logsURL=“http://juing*p1:8020/mobi-platform-rollup-solr-service/solr/monitor/rollup/policy.json” --hours=“4”
OK
root@juing01p1.integration: /etc/nrpe.d# echo $?
0

10

enabled the NRPE in debug mode and able to see this …

May 22 00:30:15 juing01p1.i nrpe[2736]: Host 10.173.96.206 is asking for command ‘check_solr_asset_updates_arg’ to be run…
May 22 00:30:15 juing01p1. nrpe[2736]: Running command: /usr/lib64/nagios/plugins/mobi/check_log_time.py --process=“solrAssetUpdateJob” --logsURL=“solrAssetUpdateJob” --hours=“solrAssetUpdateJob”
May 22 00:30:15 juing01p1.-nrpe[2737]: WARNING: my_system() seteuid(0): Operation not permitted
May 22 00:30:15 juing01p1.i nrpe[2736]: Command completed with return code 2 and output:
May 22 00:30:15 juing01p1.i nrpe[2736]: Return Code: 3, Output: NRPE: Unable to read output

11

guys figured out … supply the same argument in the nrpe.conf

$ARG1$” --logsURL=“$ARG1$” --hours=“$ARG1$” >> $ARG1$” --logsURL=“$ARG2$” --hours=“$ARG3$” worked

12

And you should run manual checks all time as the same user that icinga is running but not as root.

1 Like