Syslog Profile

System Log Profile (syslog)

This profile includes the service checks necessary to process incoming syslog messages from remote servers within GroundWork Monitor.

Services Configuration

• Service - Definitions in Monarch are stored under this name.
• Command Line - Service command name with arguments to be passed to the plugin.
• Plugin Command Line - Plugin script called by Nagios for this Service.

  Command lines displayed below are intended to be single line commands.

  Service	Command Line	Plugin Command Line
  syslog	check_syslog!ARG1!ARG2	$USER1$/check_syslog_gw.pl -l $ARG1$ -s /tmp/$HOSTNAME$.tmp -x $ARG2$ -a $HOSTADDRESS$
  syslog_last	check_syslog!ARG1!ARG2	$USER1$/check_icmp -H $HOSTADDRESS$ -w 3000.0,80% -c 5000.0,100% -n 1

Profile Package

This package includes the following files:

Profile Definitions

• service-profile-syslog.xml

Plugins Scripts on the GroundWork Server

• check_syslog_gw.pl

Installation

GroundWork Monitor includes many monitoring profiles for a variety of devices, systems and applications. Profiles already imported on a new GroundWork installation include Service Ping, SNMP Network, and SSH UNIX. The GroundWork Monitor Configuration tool is used to import updated Profiles and Profiles that require additional setup; the Profile XML file and its companion Performance Configuration definition file. Services can also be imported in addition to Service Profiles in the Profile Importer. The import process is documented under GROUNDWORK PROFILES > Importing Profiles.

Implementation

• ARG1 This should have the path of the log file. Ideally, keep the logfile in /tmp and you should have write permission by Nagios.
• ARG2 This should have the path of the regular expression file, the log file is searched for this regular expression. Ideally, keep the regular expression file in /tmp and you should have write permission by Nagios.
• The /tmp/$HOSTNAME$.tmp which is /tmp/localhost.tmp file has a value 0 which points to the starting of the logfile.

  All the files should have read, write and execute permissions by the Nagios user.

Implementation Notes

This profile is particularly useful for small to medium sized environments. However, the "syslog" service is an active check that can be quite expensive to run. Users in larger environments should consider removing this service from the profile and leaving the passive "syslog_last" service. This service can be updated by the syslog-ng facility in GroundWork Monitor. Please refer to MESSAGE PROCESSING for further details.