Linux Log Monitoring - Monitor log files and alert on log entries, Monitor single / multiple logs efficiently on Linux, AIX and SunOS, Get alert notifications on errors, patterns - Graph log file behavior and metrics, Analyze log file content, Alert on log timestamps, updatetimes, size and growth

Monitor timestamps of multiple log files

How to Monitor and Alert on the Timestamp of Multiple log files

Monitor local log files - Alert if any log's timestamp is older than X number of minutes thresholds

[root@monitor jbowman]#
[root@monitor jbowman]#
[root@monitor jbowman]# ./logxray localhost /var/tmp/logXray autodoc /opt/apache/httpd-2/3/2/htdocs/pkicrlpub,_ast_gap_inc__ast_ 4h 8h timestamp

OK: [ /opt/apache/httpd-2.4.2/htdocs/pkicrlpub/gap_inc_stores_issuing_ca_g1.crl,age=(0d/0h/39.6m ago) /opt/apache/httpd-2.4.2/htdocs/pkicrlpub/gap_inc_corp_root_ca_g1.crl,age=(0d/0h/39.6m ago) /opt/apache/httpd-2.4.2/htdocs/pkicrlpub/gap_inc_corp_issuing_ca_g1.crl,age=(0d/0h/39.6m ago) /opt/apache/httpd-2.4.2/htdocs/pkicrlpub/gap_inc_corp_intermediate_ca_g1.crl,age=(0d/0h/39.6m ago) ].

[root@monitor jbowman]#
[root@monitor jbowman]#

Monitor a remote log file - Alert if log's timestamp is older than X number of minutes thresholds (OK Status)

[root@monitor jbowman]#
[root@monitor jbowman]#
[root@monitor jbowman]# ./nlm  logxray  logxray-01.logrobot.net  /var/tmp/logXray  autodoc  /opt/apache/httpd-2/3/2/htdocs/pkicrlpub,_ast_gap_inc__ast_ 4h 8h timestamp

OK: [ /opt/apache/httpd-2.4.2/htdocs/pkicrlpub/gap_inc_stores_issuing_ca_g1.crl,age=(0d/0h/39.6m ago) /opt/apache/httpd-2.4.2/htdocs/pkicrlpub/gap_inc_corp_root_ca_g1.crl,age=(0d/0h/39.6m ago) /opt/apache/httpd-2.4.2/htdocs/pkicrlpub/gap_inc_corp_issuing_ca_g1.crl,age=(0d/0h/39.6m ago) /opt/apache/httpd-2.4.2/htdocs/pkicrlpub/gap_inc_corp_intermediate_ca_g1.crl,age=(0d/0h/39.6m ago) ].

[root@monitor jbowman]#
[root@monitor jbowman]#

Explanation:

        Monitor all files that have the pattern "gap_inc" in their names, under the /opt/apache/httpd-2/3/2/htdocs/pkicrlpub directory.

        Alert as Warning if the age of any of the discovered file is at least 4 hours old but less than 8 hours.

        Alert as Critical when the age of any of the discovered files is at least 8 hours old.

        The _ast_ is used to denote "*"

            Asterisks have the potential to cause problems, therefore, we allow users to use a predetermined string to reference them.

            In other words, when having to specify the path to a log file with asterisks in it, replace the asterisks with "_ast_"

            For example,

                This:

                    /opt/apache/httpd-2.4.2/htdocs/pkicrlpub/*gap_inc*

                Becomes:

                    /opt/apache/httpd-2/3/2/htdocs/pkicrlpub,_ast_gap_inc__ast_

Explanation of each parameter in the preceding examples - Understanding supplied arguments

Case Scenario:

Monitor files that have the pattern "gap_inc" in their names under the /opt/apache/httpd-2/3/2/htdocs/pkicrlpub directory.
Alert as Warning if the age of any of the discovered file is at least 4 hours old but less than 8 hours.
Alert as Critical when the age of any of the discovered files is at least 8 hours old.

The _ast_ is used to denote "*"

Asterisks have the potential to cause problems, therefore, we allow users to use a predetermined string to reference them. In other words, when having to specify the path to a log file with asterisks in it, replace the asterisks with "_ast_".

For example,

	This:
		/opt/apache/httpd-2.4.2/htdocs/pkicrlpub/*gap_inc*

	Becomes:
		/opt/apache/httpd-2/3/2/htdocs/pkicrlpub,_ast_gap_inc__ast_

Other common log monitoring scenarios

Log File Content

Scan content of log files for new occurrences (or lack thereof) of specific keywords, strings or patterns.

Log File Size

Monitor the sizes of single or multiple log files - alert if log size breaches predefined thresholds.

Log File Growth

Monitor the growth of single or multiple log files - alert when the monitored logs stop receiving new data.

Log File Timestamp

Monitor the timestamp of single or multiple logs. Alert, if logs are older than X amount of minutes or hours.