NSClient++ Help (#1) - CheckFiles not working (#760) - Message List

CheckFiles not working

I am following the example on the CheckFiles page.

./check_nrpe -H IP -p 5666 -c CheckFiles -a path=C:\tmp pattern=*.txt "filter=size gt 20" "syntax=%filename%: %size%" MaxWarn=1

I get the following error

Invalid types: Invalid type detected for nodes: {size}:size and {int}#20

Obviously IP is really the IP Address of the server with NSClient installed. The only thing I changed in the command is the drive from D: to C:

I also get issues when trying the creation filter

./check_nrpe -H IP -p 5666 -c CheckFiles -a path=C:\DRinfo pattern=PartitionInfo?.txt "filter=creation lt -2d"

I get the following error

Invalid types: Variable not found: creation

I get these errors with NSClient++-0.3.9-Win32-20110216-2242.zip and NSClient++-0.3.9-x64-20110216-2246.zip.

  • Message #2116

    Wow, someone using nightly build features :)

    I shall investigate... Off the top of my head I would try to add a "k" or "b" at the end. I am unsure but it could be that size is a typed "Number" Ie. not the same as a number.

    ./check_nrpe -H IP -p 5666 -c CheckFiles -a path=C:\tmp pattern=*.txt "filter=size gt 20k" "syntax=%filename%: %size%" MaxWarn=1
    

    Michael Medin

    • Message #2120

      This worked, I needed an extra backslash on the path as well.

      ./check_nrpe -H IP -p 5666 -c CheckFiles -a path=C:\\tmp pattern=*.txt "filter=size gt 20k" "syntax=%filename%: %size%" MaxWarn=1
      

      CheckFile ok|'found files'=0;1;0

    • Message #2121

      However I still get the other error when trying creation

      Invalid types: Variable not found: creation
      

      • Message #2123

        Sorry... I have been "busy" so I haven't had time to look at this... it is on my TODO list so I shall see if I can look it over this weekend...

        Michael Medin

        • Message #2153

          Hi Michael, I tried with 0.3.9 rc1 (0.3.9.307 2011-05-01) and still get the "Invalid types: Variable not found: creation".

          Just an FYI.

          • Message #2156

            Hi Box293. ./check_nrpe -H IP -p 5666 -c CheckFiles -a "path=C:\temp" "pattern=*.zip" max-dir-depth=0 "filter=written gt 3d" MaxWarn=1 MaxCrit=2

            I've tried filter=creation, filter=accessed on Windows Server 2008 R2 SP1 and they don't work for some reason. The only filter that works is filter=written.

            Make sure that you also turn set the followings in the NSC.ini file:

            allow_arguments=1 allow_nasty_meta_chars=1

            and restart the service before you try again.

            • Message #2157

              Sorry for tjis. The actual keyword names are:

              			(_T("filename"), (type_string))
              			(_T("name"), (type_string))
              			(_T("version"), (type_string))
              			(_T("path"), (type_string))
              			(_T("line_count"), (type_int))
              			(_T("size"), (type_size))
              			(_T("accessed"), (type_date))
              			(_T("written"), (type_date))
              			(_T("generated"), (type_date));
              

              I shall update the documentation and provide some samples...

              Michael Medin

              • Message #2158

                humm... just saw it says generated... thats just wrong... will need to fix...

                • Message #2159

                  This is whAT IT SHOULD BE

                  			(_T("filename"), (type_string))
                  			(_T("name"), (type_string))
                  			(_T("version"), (type_string))
                  			(_T("path"), (type_string))
                  			(_T("line_count"), (type_int))
                  			(_T("size"), (type_size))
                  			(_T("access"), (type_date))
                  			(_T("creation"), (type_date))
                  			(_T("written"), (type_date));
                  

                  I will try to make a new RC with this in the next few days, am traveling (in london for traning) so not sure when I have time to update...

                  Michael Medin

                  • Message #2172

                    Cheers Nelson, the example you provided worked for me.

                    Thanks for all the great work Michael, much appreciated. Looking forward to the final release of 0.3.9.

            • Message #2173

              I'm getting a little confused in relation to the time expression.

              I have a server that has some .reg files in c:\temp. These files were last modified in March this year and October last year. I am using these files as an example as I know they are old files.

              Taken from this link: http://nsclient.org/nscp/wiki/CheckFiles

              generated < -2d means filter will match any records older than 2 days
              

              So I want to run a check that will alert me to any files that are older than 14 days.

              So I think the time expression should be:

              written < -14d
              

              So the command should be:

              ./check_nrpe -H vault18 -t 30 -c CheckFiles -a "path=c:\temp" "pattern=*.reg" "filter=written < -14d" MaxCrit=1
              

              However the output I recieve from the command is:

              CheckFile ok|'found files'=0;0;1
              

              And this looks like an OK result instead of a critical result. I must be doing something wrong here. Any ideas?

              • Message #2191

                Time works like this...

                written < "a date" A date is a string expression given relative of "now" so -5m would translate as "now - 5 minutes" which ofcourse means "5 minutes ago". So: written < -5m translates to written < now - 5 minutes which is the same as written < 5 minutes ago. SO what you want is "older then 15 minutes" in other word a date less then 15 minutes ago so you would want written < -15m

                A good idea is to set debug=true and check the log as you will get more information there...

                Also some issues have been fixed in the latest rc (out in a bit)...

                Michael Medin

                • Message #2201

                  Thanks for the help, I've downloaded RC3 and had a bit of a play. However I am still confused. I keep getting results that don't make sense.

                  SO what you want is "older then 15 minutes" in other word a date less then 15 minutes ago so you would want "written < -15m"

                  If I understand correctly, "written < -15m" will find any files that were written in the last 15 minutes (less than 15 minutes since now)?

                  So on that same concept, "written < 15m" will find any files that were written MORE than 15 minutes ago (more than 15 minutes since now)?

                  Created a file called test.txt This file was created 2011-07-17 @ 15:20

                  There are two checks below, the only difference is <-15m or <15m. I wait 15 minutes before performing the checks. The checks below were performed 15+ minutes after the test file was created. So one of the checks below should be in a critical state and the other will be in a OK state.

                  For example if the file was created more than 15 minutes ago and the check is looking for a file that was created within the last 15 minutes ("written < -15m") then an OK result should be returned?

                  However this does not seem to be the case, they both return a critical result. Am I just not understanding how this works?

                  Here are the tests, run from the command line of the Nagios host. I run the date command first to show the current date time and then I run the command.

                  Interestingly the command seems to return results that are GMT time zone and we are in the AEST +10 timezone. Note sure if this has anything to do with my problems.

                  <-15m

                  date

                  Fri Jun 17 15:37:39 EST 2011

                  ./check_nrpe -H vault19 -t 30 -c CheckFiles -a "path=c:\temp-vault" "pattern=test.txt" "filter=written<-15m" MinCrit=1 debug=true "syntax=%filename%: %write%"

                  test.txt: Friday, June 17, 2011 05:19:13, found files: 1 < critical|'found files'=1;0;1

                  2011-06-17 15:37:43: debug:NSClient++.cpp:1144: Injecting: CheckFiles: path=c:\temp-vault, pattern=test.txt, filter=written<-15m, MinCrit=1, debug=true, syntax=%filename%: %write% 2011-06-17 15:37:43: debug:include\parsers/filter/where_filter_impl.hpp:91: Parsing: written<-15m 2011-06-17 15:37:43: debug:include\parsers/filter/where_filter_impl.hpp:91: Parsing succeeded: {tbd}op:<({tbd}:written, {tbd}fun:neg({tbd}fun:convert({tbd} { {tbd}#15, {tbd}'m', } ))) 2011-06-17 15:37:43: debug:include\parsers/filter/where_filter_impl.hpp:91: Type resolution succeeded: {bool}op:<({date}:written, {date}fun:neg({date}fun:convert({tbd} { {tbd}#15, {tbd}'m', } ))) 2011-06-17 15:37:43: debug:include\parsers/filter/where_filter_impl.hpp:91: Binding succeeded: {bool}op:<({date}:written, {date}fun:bound:neg({date}fun:bound:convert({tbd} { {tbd}#15, {tbd}'m', } ))) 2011-06-17 15:37:43: debug:include\parsers/filter/where_filter_impl.hpp:91: Static evaluation succeeded: {bool}op:<({date}:written, {date}#1308288163) 2011-06-17 15:37:43: debug:modules\CheckDisk\CheckDisk.cpp:715: NOW: 2011-06-17 05:37:43 2011-06-17 15:37:43: debug:include\parsers/filter/where_filter_impl.hpp:91: Input is: c:\temp-vault / 10 2011-06-17 15:37:43: debug:include\parsers/filter/where_filter_impl.hpp:91: File pattern: c:\temp-vault\test.txt 2011-06-17 15:37:43: debug:include\parsers/filter/where_filter_impl.hpp:91: ==> Matched: test.txt: Friday, June 17, 2011 05:19:13 2011-06-17 15:37:43: debug:include\parsers/filter/where_filter_impl.hpp:91: File pattern: c:\temp-vault\*.* 2011-06-17 15:37:43: debug:NSClient++.cpp:1180: Injected Result: CRITICAL 'test.txt: Friday, June 17, 2011 05:19:13, found files: 1 < critical' 2011-06-17 15:37:43: debug:NSClient++.cpp:1181: Injected Performance Result: found files'=1;0;1'

                  <15m

                  date

                  Fri Jun 17 15:38:07 EST 2011 ./check_nrpe -H vault19 -t 30 -c CheckFiles -a "path=c:\temp-vault" "pattern=test.txt" "filter=written<15m" MinCrit=1 debug=true "syntax=%filename%: %write%"

                  test.txt: Friday, June 17, 2011 05:19:13, found files: 1 < critical|'found files'=1;0;1

                  2011-06-17 15:38:11: debug:NSClient++.cpp:1144: Injecting: CheckFiles: path=c:\temp-vault, pattern=test.txt, filter=written<15m, MinCrit=1, debug=true, syntax=%filename%: %write% 2011-06-17 15:38:11: debug:include\parsers/filter/where_filter_impl.hpp:91: Parsing: written<15m 2011-06-17 15:38:11: debug:include\parsers/filter/where_filter_impl.hpp:91: Parsing succeeded: {tbd}op:<({tbd}:written, {tbd}fun:convert({tbd} { {tbd}#15, {tbd}'m', } )) 2011-06-17 15:38:11: debug:include\parsers/filter/where_filter_impl.hpp:91: Type resolution succeeded: {bool}op:<({date}:written, {date}fun:convert({tbd} { {tbd}#15, {tbd}'m', } )) 2011-06-17 15:38:11: debug:include\parsers/filter/where_filter_impl.hpp:91: Binding succeeded: {bool}op:<({date}:written, {date}fun:bound:convert({tbd} { {tbd}#15, {tbd}'m', } )) 2011-06-17 15:38:11: debug:include\parsers/filter/where_filter_impl.hpp:91: Static evaluation succeeded: {bool}op:<({date}:written, {date}#1308289991) 2011-06-17 15:38:11: debug:modules\CheckDisk\CheckDisk.cpp:715: NOW: 2011-06-17 05:38:11 2011-06-17 15:38:11: debug:include\parsers/filter/where_filter_impl.hpp:91: Input is: c:\temp-vault / 10 2011-06-17 15:38:11: debug:include\parsers/filter/where_filter_impl.hpp:91: File pattern: c:\temp-vault\test.txt 2011-06-17 15:38:11: debug:include\parsers/filter/where_filter_impl.hpp:91: ==> Matched: test.txt: Friday, June 17, 2011 05:19:13 2011-06-17 15:38:11: debug:include\parsers/filter/where_filter_impl.hpp:91: File pattern: c:\temp-vault\*.* 2011-06-17 15:38:11: debug:NSClient++.cpp:1180: Injected Result: CRITICAL 'test.txt: Friday, June 17, 2011 05:19:13, found files: 1 < critical' 2011-06-17 15:38:11: debug:NSClient++.cpp:1181: Injected Performance Result: found files'=1;0;1'

                  • Message #2204

                    Humm... now there could be an issue with the dates but last time I used them they worked but seems people have issues so I shall try to look it over a bit.

                    It is really not that complex :P

                    Anyways minus versus no minus:

                    • Affects "what you compare to"
                    • -15m will create a comparison point which is "15 minutes ago"
                    • 15m will create a comparison point which is 15 minutes in the future.

                    And gt versus lt:

                    • Affects "how you compare" (older versus newer)
                    • less then means "older then"
                    • greater then means "newer then"

                    In essence the "times" are converted to numbers representing the number of seconds (or microseconds or some such) (in UTC BTW) since <whatever>. So small number means "old file" large number means "new file".

                    Michael Medin

                    • Message #2213

                      OK that last explanation of "minus vs no minus" and "gt vs lt" really makes sense. So much so it would be worthwhile adding it to the documentation section about filters.

                      However even when I apply this logic I still cannot get it to work the way it is supposed to.

                      So I have a file that is 11 days oldds

                      This check will look for files created within the last 15 minutes

                      ./check_nrpe -H vault19 -t 30 -c CheckFiles -a "path=c:\temp-vault" "pattern=test.txt" "filter=written > -15m" MinCrit=1 debug=true "syntax=%filename%: %write%"

                      found files: 0 < critical|'found files'=0;0;1

                      This output looks correct. It is an older file so it won't match the filter.

                      This check will look for files created more than 15 minutes ago

                      ./check_nrpe -H vault19 -t 30 -c CheckFiles -a "path=c:\temp-vault" "pattern=test.txt" "filter=written < -15m" MinCrit=1 debug=true "syntax=%filename%: %write%"

                      test.txt: Friday, June 17, 2011 05:19:13, found files: 1 < critical|'found files'=1;0;1

                      This output looks correct. It is an older file so it will match the filter.

                      This check will look for files created more than 14 days ago.

                      ./check_nrpe -H vault19 -t 30 -c CheckFiles -a "path=c:\temp-vault" "pattern=test.txt" "filter=written < -14d" MinCrit=1 debug=true "syntax=%filename%: %write%"

                      test.txt: Friday, June 17, 2011 05:19:13, found files: 1 < critical|'found files'=1;0;1

                      This output is incorrect. The file was created 11 days ago and I set my filter to 14 days. Even when i set the filter to 30 days it still appears to match the filter (it should not be matching)

                      ./check_nrpe -H vault19 -t 30 -c CheckFiles -a "path=c:\temp-vault" "pattern=test.txt" "filter=written < -30d" MinCrit=1 debug=true "syntax=%filename%: %write%"

                      test.txt: Friday, June 17, 2011 05:19:13, found files: 1 < critical|'found files'=1;0;1

                      Are you able to confirm this behaviour?

                      • Message #2214

                        It is on my todo list... so hopefully tonight...

                        Michael Medin

                      • Message #2215

                        Yes it was pretty broken... Will be fixed in the next rc.

                        Wrote a script to verify the logic as well which looks like this (script will be attached to this thread). The script creates a bunch of files (5) and execute a set of nsclient++ commands to verify that the number of matches are correct...

                        cd <nsclient folder>
                        D:\test\date\setup.py d:\test\date
                        OK: filter=written lt -6m resulted in: 1 files [-10.txt|'found files'=1;1;0]
                        OK: filter=written gt -6m resulted in: 4 files [+00.txt, +05.txt, +10.txt, -05.txt|'found files'=4;4;0]
                        OK: filter=written lt -4m resulted in: 2 files [-05.txt, -10.txt|'found files'=2;2;0]
                        OK: filter=written gt -4m resulted in: 3 files [+00.txt, +05.txt, +10.txt|'found files'=3;3;0]
                        OK: filter=written lt 4m resulted in: 3 files [+00.txt, -05.txt, -10.txt|'found files'=3;3;0]
                        OK: filter=written gt 4m resulted in: 2 files [+05.txt, +10.txt|'found files'=2;2;0]
                        OK: filter=written lt 6m resulted in: 4 files [+00.txt, +05.txt, -05.txt, -10.txt|'found files'=4;4;0]
                        OK: filter=written gt 6m resulted in: 1 files [+10.txt|'found files'=1;1;0]
                        

                        Michael Medin

                        • Message #2216

                          Great stuff.

                          Clearly the broken stuff was clouding my understanding of the filter stuff with gt lt -. I learn by testing and it wasn't working as expected so I was getting confused.

                          Looking forward to the next RC. Really appreciate the work you do on this.

                          Thanks

                          Troy Lea

                          • Message #2217

                            The "next RC" is the rc5 I released last night so feel free to try it...

                            Michael Medin

                            • Message #2220

                              So, I too had this problem, but when I tried installed rc5 to test it out, got the following:

                              MSI (s) (E0:18) [15:04:17:678]: Product: NSClient++ (Win32) -- x64 bit version not supported (by installer) on Win32 bit platform (get Win32 bit version instead)

                              MSI (s) (E0:18) [15:04:17:678]: Product: NSClient++ (Win32) -- Installation failed.

                              It would seem the Win32 msi actually contains x64 stuff?

                              EDIT: Please disregard, seems it is me that is installing too many instances at the same time.

                              -Arthur

                            • Message #2221

                              OK that is working nicely in rc5, great stuff.

                              One last question.

                              This check will look for files created more than 14 days ago.

                              ./check_nrpe -H vault19 -t 30 -c CheckFiles -a "path=c:\temp-vault" "pattern=*.zip" "filter=written < -14d" MinCrit=1 debug=true "syntax=%filename%: %write%"

                              Is there a way to make it error if it doesn't find ANY *.zip files? My check is looking for older files to ensure that the scheduled task on that server hasn't stopped running. But if it doesn't find any files then this won't cause a trigger.

                              • Message #2222

                                Using exact boundries should make that possible yes... things like warn=eq:0 crit=eq:0

                                Michael Medin

Subscriptions