mk_logwatch: inform customer if logfile is not readable

37 votes

From time to time it can happen that log files can no longer be read or can't be found.

In this case, a corresponding error message should be generated so that you can react to it.

Released Checks&Agents Log monitoring / Event Console Suggested by: Lars Sörensen (12 May, '22) • Upvoted: 12 Apr, '23 • Comments: 7

Comments: 7

28 Jul, '22
Mike1098
I the logwatch event forwarding rule you have several options to monitor the availability of log files:

Warn if list of forwarded logfiles changes
List of expected logfiles
Create a separate check for each logfile
10 Nov, '22
Daniel
@Mike
Why to create a seperate check if the information could be present in the same place?
Why creating a workaround for something straight forward?
Another point of failure and another annoying thing when it comes to reporting at the end
24 Nov, '22
Mike1098
@Daniel I do not understand your comment.
These options are available since long in the rule "Logwatch Event Console Forwarding"
No separate check; Its implemented in the check_mk-logwatch_ec
17 Dec, '22
Lars Sörensen
@Mike1098
if you have "Create a separate check for each logfile" selected:
1. if the logfile initially is not available (missing) no service is created, why?
2. if the logfile initially cannot be read (cannotopen) no service is created, why?
3. if the logfile cannot be read anymore (cannotopen) then services is going to Unknown and "log not present anymore" is reported. But in this case the Files is still present, so why is the services not going to warn/crit and reports "log file '/var/log:important.log' cannot be accessed".

It is not an unknown error, therefore the problem should be properly named
10 Jan, '23
Mike1098
As far as I understand there is only one service necessary with rule "Logwatch Event Console Forwarding". No need for separate service per logfile.
I need to check in 2.0 what is the result of a violation of the option "Monitoring of forwarded logfiles" "Warn if list of forwarded logfiles changes"
1. and 2. is most probably related to discovery feature.
At least it should be covered by the option "List of expected logfiles"
I also here need to check the current behavior in 2.0.
3. I somehow agree. Even because we do not really care about UNKNOWN alerts. For me this is not a new feature but needs to be handled as a bug.

For further discussions I would recommend to use the forum thread. I am open to do some tests and share screenshots there if you feed me with details.
09 May, '23
Lars Sörensen
Status: In Progress... SUP-12770
15 May, '23
Thomas Lippert Admin
https://checkmk.com/werk/15266
https://checkmk.com/werk/15264
Will come with 2.1.0p28 and 2.2.0b8