NAME
Monitoring::Sneck::Checks::log - checks new lines in a log for a regex
VERSION
Version 0.0.1
SYNOPSIS
auth_fails|perl:log -f /var/log/auth.log -r 'Failed password' -c 10
kernel_errors|perl:log -f /var/log/messages -r 'I/O error|Medium Error' -x 'cd0' -H 3600DESCRIPTION
Reads the lines added to a log since it was last run and counts those matching any --regex and none of --exclude, the same as check_log. The count is checked against the ranges, so by default any is WARNING.
Where it got to is kept in a state file, one per log and set of regexes and excludes unless --state is given. A log that was rotated, a new inode, or truncated, smaller than before, is read from the start. The first time, it starts at the end, so what was already there is not counted, unless --from-start is given. Only whole lines are read, so a line still being written is left for next time.
A match is only seen by the one run that reads it, so the next run is OK again, which a poll can easily miss. --hold keeps reporting the last matches for that many seconds after.
Running it by hand, such as through sneck_check, moves the state on as well, so give it a --state of its own for that.
Not being able to read the log or the state, or write the state, is UNKNOWN.
OPTIONS
- -f, --file :: The log. Required.
- -r, --regex :: A regex for lines to count. May be given more than once, any matching is enough. Required.
- -x, --exclude :: A regex for lines not to count. May be given more than once.
- -w, --warning :: Range for the number of lines. Default :: 0
- -c, --critical :: Range for the number of lines.
- -H, --hold :: Seconds to keep reporting matches for. Default :: 0
- -n, --lines :: How many matching lines to list after the status line, once it is not OK. Default :: 5
- -s, --state :: The state file. Default :: under /var/cache/sneck.checks, named by --file, --regex, and --exclude
- --from-start :: The first time, read the whole log.
METHODS
check
Does the check.
state_file
Returns the state file, --state or one under the state directory named by --file, --regex, and --exclude.
read_lines
Reads the whole lines of a file from a offset.
- file :: The file.
- offset :: Where to start.
Returns a array ref of the lines, without line endings, and the offset after the last whole line. Or undef and why if it can not be read.