Directory

1st!!!!!!!!!!!!

define command{
command_name check_logwarn
command_line bash /usr/lib/nagios/plugins/check_logwarn -d /tmp/logwarn -p $ARG1$ $ARG2$
#ARG1 is file ARG2 is regex
}

define service{
use generic-service
host_name HOSTNAME
service_description Log Warning
max_check_attempts 1
check_command check_logwarn!/var/log/file.log!^.*YOURWORDHERE.*
}

needed to add -d /tmp/logwarn dir. Make sure to chown nagios.nagios /tmp/logwarn. Maybe it would be better to place in /var/lib/nagios3/logwarn it's up to you.

Also set max_check_attempts to 1 as my default was 4. so it would take 4 failures in a row to actually trigger a notification. I was really stumped on this for a bit! Save yourself some pain and set it to 1. My setup may still need some tweaking but it is working well enough right now.

Our nagios box is a syslog server and recieves logs from our switches/routers. I am able to watch for certain events with this plugin.

I have yet to see how it works with logrotate but it apparently does support on what the man page reads.

Thanks! This a great plugin that solves some clumsy limitations we have.