[NSClient++] Topic #443 - Checking for old Files

Topic #443 - Checking for old Files

bunnu — Fri, 21 Aug 2009 08:53:11 GMT

Hi,

I need to check if there are certain files in a directory which are older then 1 hour. I'm using ChecFfile2 with following syntax:

./check_nrpe -H 172.18.15.101 -c CheckFile2 -a file="n:\\spooler\\mailbox" pattern="*.bit" filter-written=\>"2h"

The result is always "CheckFile ok|'no files found'=0;0;0;", even if there are Files with *.bit older then 2 hours.

The logfile of nsclient shows this:

2009-08-21 10:45:17: debug:NSClient++.cpp:1034: Injecting: CheckFile2: file=n:\spooler\mailbox, pattern=*.bit, filter-written=>2h
2009-08-21 10:45:17: debug:modules\CheckDisk\CheckDisk.cpp:112: Input is: n:\spooler\mailbox / ffffffff
2009-08-21 10:45:17: debug:modules\CheckDisk\CheckDisk.cpp:126: File pattern: n:\spooler\mailbox\*.bit
2009-08-21 10:45:17: debug:modules\CheckDisk\CheckDisk.cpp:136: File pattern: n:\spooler\mailbox\*.*
2009-08-21 10:45:17: debug:include\checkHelpers.hpp:758: Missing bounds for maxmin-bounds check: no files found
2009-08-21 10:45:17: debug:NSClient++.cpp:1070: Injected Result: OK 'CheckFile ok'
2009-08-21 10:45:17: debug:NSClient++.cpp:1071: Injected Performance Result: ''no files found'=0;0;0; '

Am I using a wrong syntax, or is there a bug in CheckFile? Could anyone please help me?

Thanks,

Benjamin

Reply #1516 to topic #443 - Checking for old Files

mickem — Sun, 13 Dec 2009 09:35:46 GMT

Uhmm, which issue? Arguments for Lua has been there for several versions (as per my example).

function debug (command, args)
    table.foreachi(args, print)
    print ('Command was: ' .. command)
    return 'ok', 'hello'
end

The reference there iiis for the NRPEClient proxy which I assume you are note interested in?

Michael Medin

Reply #1494 to topic #443 - Checking for old Files

fgeek — Tue, 03 Nov 2009 07:06:53 GMT

Are you going to implement that feature as we need it? I noticed that http://nsclient.org/nscp/blog/category/0.3.7 says "Added argument support to NRPE Client" what does that exactly mean?

Reply #1480 to topic #443 - Checking for old Files

mickem — Wed, 14 Oct 2009 17:16:27 GMT

Ohh... that is probably old, didn't even know I had written a guide on that :)

Michael Medin

Reply #1479 to topic #443 - Checking for old Files

fgeek — Wed, 14 Oct 2009 13:28:18 GMT

http://nsclient.org/nscp/wiki/LUAScript/guide

"As of now there are no support for arguments but in the future they will be added."

check_nrpe2 -H foo.example.com -p 5666 -c lua_command -a foo=1 bar=2

Reply #1478 to topic #443 - Checking for old Files

mickem — Wed, 14 Oct 2009 08:16:20 GMT

There is no arguments for lua scripts?

are you sure?

function debug (command, args)
    table.foreachi(args, print)
    print ('Command was: ' .. command)
    return 'ok', 'hello'
end

From the supplied sample command

Michael Medin

Reply #1477 to topic #443 - Checking for old Files

fgeek — Wed, 14 Oct 2009 06:40:22 GMT

Ok. I thought this kind of functionality might be the issue. Thank you for your support. I can provide documentation later how to add correct permissions to use UNC-locations.

I noticed that there isn't a ticket about LUAScript arguments. This is very needed feature. Can I add the ticket by myself or will you do it?

Reply #1474 to topic #443 - Checking for old Files

mickem — Tue, 13 Oct 2009 17:46:11 GMT

Hello,

Absolutely First I define the following aliases:

mime1=checkFile2 filter=in path=x:\nscp pattern=*.txt filter+written=<1d MaxWarn=1 MaxCrit=1 "syntax=%filename% %write%"
mime2=checkFile2 filter=in path=\\192.168.0.1\data\nscp pattern=*.txt filter+written=<1d MaxWarn=1 MaxCrit=1 "syntax=%filename% %write%"

Then I run in test mode and get the following:

mickem@gotrek:~/nsc$ $nrpe -c mime1
test.txt Tuesday, October 13, 2009 17:12:15, test.txt: 1 > critical|'test.txt'=1;1;1;
mickem@gotrek:~/nsc$ $nrpe -c mime2
test.txt Tuesday, October 13, 2009 17:12:15, test.txt: 1 > critical|'test.txt'=1;1;1;

So now we know "UNC" paths are working... lets move on...

Then I start the service and run the commands and I get:

mickem@gotrek:~/nsc$ $nrpe -c mime1
CheckFile ok|'no files found'=0;1;1;
mickem@gotrek:~/nsc$ $nrpe -c mime2
CheckFile ok|'no files found'=0;1;1;

Now this is might at first glancve seem like a bug but it is the correct results. The reason is that the service runs as "local system"(?) and "local system" does not have access to the shares above (if you check the nscp log you can see something fishy is going on).

Anyways, changing the user to "mickem" (the one I use which has access to the shares in question) gives the following: (since I don't have AD at home it is sort of hard to give fine grained access to the service user).

mickem@gotrek:~/nsc$ $nrpe -c mime1
CheckFile ok|'no files found'=0;1;1;
mickem@gotrek:~/nsc$ $nrpe -c mime2
test.txt Tuesday, October 13, 2009 17:12:15, test.txt: 1 > critical|'test.txt'=1;1;1;

Again this is expected the reason this time is that the mapped drives is mapped by me in my session where as the service is my user it does not share my session. But the second one works splendidly since it accesses thew remote share and not the mapped drive.

Presumably you can also add the "x:\" to the login script of the service but I have not tested that.

All of this is pretty much basic "Windows administrator 101" (or for that matter Unix administrator 101).

And I know that a lot of the problem people have is related to accounts and security and such but unfortunately it is outside the scope of this wiki to have windows configuration and administration tips.

Though I would like to add that perhaps I shall add a better error message since the only thing you get in the log is:

2009-10-13 19:33:58: debug:NSClient++.cpp:1073: Injecting: checkFile2: filter=in, path=x:\nscp, pattern=*.txt, filter+written=<1d, MaxWarn=1, MaxCrit=1, syntax=%filename% %write%
2009-10-13 19:33:58: debug:modules\CheckDisk\CheckDisk.cpp:116: Input is: x:\nscp / ffffffff
2009-10-13 19:33:58: debug:modules\CheckDisk\CheckDisk.cpp:119: Found a file dont do recursive scan: x:\nscp
2009-10-13 19:33:58: debug:modules\CheckDisk\CheckDisk.cpp:334: Looking for: path: x:, pattern: nscp
2009-10-13 19:33:58: debug:modules\CheckDisk\CheckDisk.cpp:122: Path is: x:

Which, unfortunately, does not really tell you what the problem is. I shall investigate this but unfortunately the "recursive model" used now is not really good for handling errors.

I hope this help! If not please send the debug log of NSClient++ running.

Michael Medin

Reply #1471 to topic #443 - Checking for old Files

fgeek — Tue, 13 Oct 2009 13:22:34 GMT

Better yet give me a line, which does work. For example
foo\bar with pattern *.txt

I have tried several days without success. I also got problems with LUAScript when I need to check if directory is empty and I want to return different output to NRPE and Nagios in different parts of the code. Most of the time it says "No handler returned from script." even thought it is working using /test (I noticed it just jumps to last end when running as service) and sometimes when I use return inside some function nsclient returns that output to nrpe even it should returned it to another function. I believe it is faster to code the functionality of NSClient in Perl and stop using this in all our Windows-machines.

The debugging of LUA-script sucks. One can't trust it at all
Missing and bad documentation about CheckDisk- and LUA-modules

You can test to add check for "File Not Found" to my script abose. At least I didn't get it to work after nine hours of coding and testing. I am going to wait few days for replies and after that I am not touching this software again to prevent braindamage :)

Reply #1461 to topic #443 - Checking for old Files

mickem — Sun, 11 Oct 2009 18:51:37 GMT

Interesting to see you solved it with Lua (I always like when people actually use it) :)

Anyways I know a lot of people who tell me "it does not work with UNC paths" but it always does for me.

So could someone post a debug log from a "does not work with UNC paths" ?

Michael Medin

Reply #1456 to topic #443 - Checking for old Files

fgeek — Fri, 09 Oct 2009 13:05:19 GMT

Since I had timeline to do this check I created it using LUA. C: is mapped filesystem.

nscp.register('check_file_age', 'init_check_wrapper')
function init_check_wrapper (command)
  if check_age() == 1 then
    return 'ok', 'Material has been under 12 hours in work-directory.'
  else
    return 'crit', 'Material has been over 12 hours in work-directory'
  end
end
function check_age (command)
  current_date = os.time()
  -- starts program in a separated process and returns a file handle that you can use to read data from
  -- io.popen is system dependent, but should work in POSIX and Windows
  stream = io.popen("dir /TC /OD C:\\foo\\bar*","r")
  for line in stream:lines() do
    if line:match("(%d%d).(%d%d).(%d%d%d%d)") ~= nil then
      day, month, year = string.match(line,"(%d%d).(%d%d).(%d%d%d%d)")
      date_of_directory = os.time{year=(year),month=(month),day=(day)}
      diff = os.difftime(current_date, date_of_directory)
      minutes_in_directory = diff / 60
      hours_in_directory = minutes_in_directory / 60
      if hours_in_directory < 12 then
        return 1
      else
        return 0
      end
    end
  end
end

Reply #1447 to topic #443 - Checking for old Files

fgeek — Wed, 07 Oct 2009 13:28:31 GMT

Is there any way to check mapped filesystems or UNC-paths? This is hopefully last issue of mine.

My test does work when the directory is in C:\, but not in Z:\, which is the mapped
foo\bar.

Reply #1440 to topic #443 - Checking for old Files

nschmitz — Fri, 25 Sep 2009 08:21:29 GMT

Hello,

It seems that checkFile2 (nsclient 0.3.7.344 2009-09-20) is also not working with file on a mounted iso (daemon tool) : If I try to check file on local disk, it works fine, but if I try with a mounted iso, nsclient just stop working and quit :

input :

/usr/lib/nagios/plugins/check_nrpe -H XXXX -c CheckFile2 -a file="h:" pattern="*.exe" MaxCrit=1 filter+size=\>0

output on nsclient console (launch with /test):

d NSClient++.cpp(1066) Injecting: CheckFile2: file=h:, pattern=*.exe, MaxCrit=1,
 filter+size=>0
d \CheckDisk.cpp(116) Input is: h: / 11
d \CheckDisk.cpp(131) File pattern: h:\*.exe
d \CheckDisk.cpp(632) result: 1 -- 1
C:\Program Files\NSClient++>

Thanks for any tip.

Reply #1439 to topic #443 - Checking for old Files

bunnu — Tue, 22 Sep 2009 08:37:56 GMT

Hello Michael,

thanks for your help. Right now I just realized that CheckFile2 is working when I'm checking Files on a local harddisk. Bur I need to check files on a (mapped) network drive. I already tried other network drives mapped to this server, but it seems that CheckFile doesn't finds any files.

Benjamin

Reply #1438 to topic #443 - Checking for old Files

mickem — Sun, 20 Sep 2009 20:13:22 GMT

It works splendidly for me (adding filter=out or in):

CheckFile2 filter=in path=C:\test\ pattern=*.txt MaxCrit=1 filter+written=>2h
CRITICAL:001.txt, 002.txt, 003.txt, 001.txt, 002.txt, ...: 3 > critical|'001.txt, 002.txt, ...'=3;0;1;

CheckFile2 filter=in path=C:\test\ pattern=*.txt MaxCrit=1 filter+written=<2h
CRITICAL:003.txt, 005.txt, 003.txt, 005.txt: 2 > critical|'003.txt, 005.txt'=2;0;1;

Only thing which bothers me is that the names end up in the result list twice but the counters are all correct.

MickeM

Reply #1412 to topic #443 - Checking for old Files

bunnu — Tue, 01 Sep 2009 10:33:18 GMT

Hi Michael,

thanks for your help. Unfortunally it is still not working :( I'm using the newest nightly build (20090830-2237).

I' tried following commands:

./check_nrpe -H 172.18.15.101 -c CheckFile2 -a path=n:\\spooler\\mailbox pattern=*.BIT MaxCrit=1 filter+written=\>2h
./check_nrpe -H 172.18.15.101 -c CheckFile2 -a path=n:\\spooler\\mailbox pattern=*.BIT MaxCrit=1 filter+written=gt:2h

Regards,

Benjamin

Reply #1405 to topic #443 - Checking for old Files

mickem — Sat, 29 Aug 2009 19:14:54 GMT

The problem here is the "-" means "remove those files".

I need to write the docs for this I kkow :)

It works like eventlog: so: + = "add"

= "remove"

. = "keep"

sorry for not catching it sooner...

CheckFile2 path=c:\test pattern=*.txt MaxCrit=1 filter+written=gt:2h

Michael Medin

Reply #1384 to topic #443 - Checking for old Files

bunnu — Mon, 24 Aug 2009 10:42:41 GMT

Hello,

right now I'm testing with following commands:

./check_nrpe -H 172.18.15.101 -c CheckFile2 -a path="n:\\spooler\\mailbox" pattern="*.bit" MaxCrit="1"
./check_nrpe -H 172.18.15.101 -c CheckFile2 -a file="n:\\spooler\\mailbox" pattern="*.bit" MaxCrit="1"
./check_nrpe -H 172.18.15.101 -c CheckFile2 -a path="n:\\spooler\\mailbox" pattern="*.bit" MaxCrit="1" filter-written=\>"2h"
./check_nrpe -H 172.18.15.101 -c CheckFile2 -a file="n:\\spooler\\mailbox" pattern="*.bit" MaxCrit="1" filter-written=\>"2h"

Thankyou,

Benjamin

Reply #1383 to topic #443 - Checking for old Files

mickem — Mon, 24 Aug 2009 08:53:34 GMT

Give me the full command you use and I shall look into it tonight...

Michael Medin

Reply #1382 to topic #443 - Checking for old Files

bunnu — Mon, 24 Aug 2009 07:58:25 GMT

Now I tried the Checkdisk.dll from the nightly build but it didn't work too.

Reply #1381 to topic #443 - Checking for old Files

bunnu — Mon, 24 Aug 2009 07:49:04 GMT

Hi,

I tried several versions. Right now I'm using Version 0.3.6.818 2009-06-14 on Windows 2003 Server.

Reply #1380 to topic #443 - Checking for old Files

mickem — Mon, 24 Aug 2009 07:44:08 GMT

BTW, which version?

CheckDisk 0.3.6 is "broken" (try the dll from the nightly)

Michael medin

Reply #1379 to topic #443 - Checking for old Files

bunnu — Sat, 22 Aug 2009 06:18:58 GMT

Hi,

i already tried using bounds like MaxCrit=1, but it still doesn't works. It seems as CheckFile doesn't recognize any files in the directory.

Benjamin

Reply #1378 to topic #443 - Checking for old Files

mickem — Fri, 21 Aug 2009 16:07:27 GMT

You need bounds as well:

Missing bounds for maxmin-bounds check: no files found

MaxWarn and MaxCrit (or min)

Michael Medin