StackOverflow2013

Note that there are some explanatory texts on larger screens.

plurals

PO
text
Body
copied!<p>Nothing in your config jumps out at me as being misconfigured. </p> <p>By design, check_log will only show either an OK message, or the last log entry that triggered an alert. If you need to see multiple entries, you'll need to modify the plugin.</p> <p>However, I find the fact that you're not getting recoveries somewhat odd. The way check_log works (by comparing the current log to the previous version), you should get a recovery on the very next service check. Except of course, when there have been additional matching entries added to the log since the last check.</p> <p>Does forcing another service check (or several) cause it to recover?</p> <p>Also, I don't intend this in a mean way, but make sure it's really malfunctioning. Is your log getting additional matching entries in between checks, causing it not to recover? Your check is matching "?" which will match anything new in the log. Is something else (a non-error) being added to the log and inadvertently causing a match?</p> <p>If none of the above are the issue, I would suggest narrowing it down by taking Nagios out of the equation. Try running check_log manually (from the command line, but as the same user as nagios), and with a different oldlog. It should go something like this -</p> <ol> <li>run check with a new "oldlog" - get initialization message</li> <li>run check - check OK</li> <li>make change to log</li> <li>run check - check fails</li> <li>run check - check OK</li> </ol> <p>If this doesn't work, then you know to focus on the log, the oldlog, and how the check_log is doing the check.</p> <p>If it works, then it points more towards a problem with your nagios configuration.</p>

Querying!

Guidance

An individual column

Larger individual text columns get their own page to allow for proper reading.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload