Context Navigation

NSClient++ Help (#1) - CheckFiles Time Expression problem (wrong output) (#842) - Message List

CheckFiles Time Expression problem (wrong output)

First of all, thanks for all the time and effort you are putting into this. NSClient++ has been very helpful to be over the past.

But now I have a problem with the CheckFiles command, using time expressions.

Goal is to check if a backup file was created over night. Therefor I want to check a directory (and it's subdirectories) to see if a certain file was created in the last 24 hours. Subdirectories are necesaary because each backup is created in a new directory, containing the date.

Therefor I use the following command:

checkfiles "path=c:\dir1\dir2\dir3\backup\" pattern=filename.bck "syntax=%path%" "filter=creation lt -1d" warn=eq:0 crit=eq:0

This gives me the following result of:

found files'=16;0;0

16 files is clearly the wrong output, because I'm expecting 1.

I did some testing and I found out that it was including all backups sincs 28 july in its result (hence the syntax=%path%). The folder contains even older backups, but those are not being counted... (there are 199 backup dirs in that folder, going back to januari)

So for a test I remove all backups after 28 july except the latest one, and then I get the expected result of 1.

I double checked to be sure that the files in the folders from 28 july and later did had the creation date of those dates, and they do... So I though these files might be corrupt, or whatever, and I moved them permantly, hoping the error was gone. This was yesterday.

Overnight a new backup was created. So now I had subdirectories for a lot of backups before 28 july, one of 11 august and one from today (12 august). I ran the command again and got a result of 2...

It's also counting the backup of yesterday again. I'm puzzled...

Do you have any idear on how to solve this?

Thanks in advance,

Tree View Flat View (newer first) Flat View (older first)

Message #2265

You have the lt/gt messed up...

lt less than means "older" (low values far away BACK in time, think seconds from <random start date here>).
gt greater than means "newer" (high values near away in time, think seconds from <random start date here>).

Michael Medin

Message #2266

Michael,

Thank you for your fast answer.

I changed lt to gt:

checkfiles "path=c:\dir1\dir2\dir3\backup\" pattern=filename.bck "syntax=%path%" "filter=creation gt -1d" warn=eq:0 crit=eq:0

Output=134 files...

Also when I set "gt 1d", so no minus symbol, the output is 134.

What am I missing here?

Message #2267

humm... sounds strange... Could you try adding the date (%creation%, %access%, %write%) to the syntax so we can see what date it thinks the files are.

I would also try adding debug=true to the command run with debug logging enabled and see if there is anything there.

Michael Medin

Message #2269

I've added (%creation%, %access%, %write%) to the syntax, the output became to long so needed to use truncate. This is the result:

checkfiles truncate=4095 "path=dir1\dir2\dir3\backup" pattern=file.bck "syntax=%creation%,%access%,%write%" "filter=creation gt 1d" warn=eq:0 crit=eq:0
d NSClient++.cpp(1144) Injecting: checkfiles: truncate=4095, path=dir1\dir2\dir3\backup, pattern=file.bck, syntax=%creation%,%access%,%write%, filter=creation gt 1d, warn=eq:0, crit=eq:0
d NSClient++.cpp(1180) Injected Result: OK 'Tuesday, January 25, 2011 03:01:47,T
uesday, January 25, 2011 03:01:47,Tuesday, January 25, 2011 03:01:47, Wednesday,
January 26, 2011 03:01:51,Wednesday, January 26, 2011 03:01:51,Wednesday, Janua
ry 26, 2011 03:01:51, Thursday, January 27, 2011 03:01:51,Thursday, January 27,
2011 03:01:51,Thursday, January 27, 2011 03:01:51, Friday, January 28, 2011 03:0
1:50,Friday, January 28, 2011 03:01:50,Friday, January 28, 2011 03:01:51, Saturd
ay, January 29, 2011 03:00:08,Saturday, January 29, 2011 03:00:08,Saturday, Janu
ary 29, 2011 03:00:08, Sunday, January 30, 2011 03:00:09,Sunday, January 30, 201
1 03:00:09,Sunday, January 30, 2011 03:00:10, Monday, January 31, 2011 03:01:49,
Monday, January 31, 2011 03:01:49,Monday, January 31, 2011 03:01:50, Tuesday, Fe
bruary 01, 2011 03:01:46,Tuesday, February 01, 2011 03:01:46,Tuesday, February 0
1, 2011 03:01:47, Wednesday, February 02, 2011 03:01:48,Wednesday, February 02,
2011 03:01:48,Wednesday, February 02, 2011 03:01:48, Thursday, February 03, 2011
03:01:51,Thursday, February 03, 2011 03:01:51,Thursday, February 03, 2011 03:01
:51, Friday, February 04, 2011 03:01:47,Friday, February 04, 2011 03:01:47,Frida
y, February 04, 2011 03:01:47, Saturday, February 05, 2011 03:00:10,Saturday, Fe
bruary 05, 2011 03:00:10,Saturday, February 05, 2011 03:00:10, Sunday, February
06, 2011 03:00:08,Sunday, February 06, 2011 03:00:08,Sunday, February 06, 2011 0
3:00:08, Monday, February 07, 2011 03:01:51,Monday, February 07, 2011 03:01:51,M
onday, February 07, 2011 03:01:52, Tuesday, February 08, 2011 03:01:46,Tuesday,
February 08, 2011 03:01:46,Tuesday, February 08, 2011 03:01:46, Wednesday, Febru
ary 09, 2011 03:01:56,Wednesday, February 09, 2011 03:01:56,Wednesday, February
09, 2011 03:01:57, Thursday, February 10, 2011 03:01:43,Thursday, February 10, 2
011 03:01:43,Thursday, February 10, 2011 03:01:43, Friday, February 11, 2011 03:
01:50,Friday, February 11, 2011 03:01:50,Friday, February 11, 2011 03:01:50, Sat
urday, February 12, 2011 03:00:09,Saturday, February 12, 2011 03:00:09,Saturday,
February 12, 2011 03:00:09, Sunday, February 13, 2011 03:00:06,Sunday, February
13, 2011 03:00:06,Sunday, February 13, 2011 03:00:07, Monday, February 14, 2011
03:01:46,Monday, February 14, 2011 03:01:46,Monday, February 14, 2011 03:01:47,
Tuesday, February 15, 2011 03:01:45,Tuesday, February 15, 2011 03:01:45,Tuesday
, February 15, 2011 03:01:45, Wednesday, February 16, 2011 03:09:30,Wednesday, F
ebruary 16, 2011 03:09:30,Wednesday, February 16, 2011 03:09:31, Thursday, Febru
ary 17, 2011 03:01:55,Thursday, February 17, 2011 03:01:55,Thursday, February 17
, 2011 03:01:56, Friday, February 18, 2011 03:01:58,Friday, February 18, 2011 03
:01:58,Friday, February 18, 2011 03:01:58, Saturday, February 19, 2011 03:09:09,
Saturday, February 19, 2011 03:09:09,Saturday, February 19, 2011 03:09:09, Sunda
y, February 20, 2011 03:08:47,Sunday, February 20, 2011 03:08:47,Sunday, Februar
y 20, 2011 03:08:48, Monday, February 21, 2011 03:10:26,Monday, February 21, 201
1 03:10:26,Monday, February 21, 2011 03:10:26, Tuesday, February 22, 2011 03:09:
35,Tuesday, February 22, 2011 03:09:35,Tuesday, February 22, 2011 03:09:35, Wedn
esday, February 23, 2011 03:09:15,Wednesday, February 23, 2011 03:09:15,Wednesda
y, February 23, 2011 03:09:15, Thursday, February 24, 2011 03:09:14,Thursday, Fe
bruary 24, 2011 03:09:14,Thursday, February 24, 2011 03:09:14, Friday, February
25, 2011 03:09:24,Friday, February 25, 2011 03:09:24,Friday, February 25, 2011 0
3:09:24, Saturday, February 26, 2011 03:09:09,Saturday, February 26, 2011 03:09:
09,Saturday, February 26, 2011 03:09:09, Sunday, February 27, 2011 03:09:01,Sund
ay, February 27, 2011 03:09:01,Sunday, February 27, 2011 03:09:01, Monday, Febru
ary 28, 2011 03:09:35,Monday, February 28, 2011 03:09:35,Monday, February 28, 20
11 03:09:36, Tuesday, March 01, 2011 03:09:45,Tuesday, March 01, 2011 03:09:45,T
uesday, March 01, 2011 03:09:46, Wednesday, March 02, 2011 03:09:52,Wednesday, M
arch 02, 2011 03:09:52,Wednesday, March 02, 2011 03:09:53, Thursday, March 03, 2
011 03:09:40,Thursday, March 03, 2011 03:09:40,Thursday...'
d NSClient++.cpp(1181) Injected Performance Result: ''found files'=134;0;0'
OK:Tuesday, January 25, 2011 03:01:47,Tuesday, January 25, 2011 03:01:47,Tuesday
, January 25, 2011 03:01:47, Wednesday, January 26, 2011 03:01:51,Wednesday, Jan
uary 26, 2011 03:01:51,Wednesday, January 26, 2011 03:01:51, Thursday, January 2
7, 2011 03:01:51,Thursday, January 27, 2011 03:01:51,Thursday, January 27, 2011
03:01:51, Friday, January 28, 2011 03:01:50,Friday, January 28, 2011 03:01:50,Fr
iday, January 28, 2011 03:01:51, Saturday, January 29, 2011 03:00:08,Saturday, J
anuary 29, 2011 03:00:08,Saturday, January 29, 2011 03:00:08, Sunday, January 30
, 2011 03:00:09,Sunday, January 30, 2011 03:00:09,Sunday, January 30, 2011 03:00
:10, Monday, January 31, 2011 03:01:49,Monday, January 31, 2011 03:01:49,Monday,
January 31, 2011 03:01:50, Tuesday, February 01, 2011 03:01:46,Tuesday, Februar
y 01, 2011 03:01:46,Tuesday, February 01, 2011 03:01:47, Wednesday, February 02,
2011 03:01:48,Wednesday, February 02, 2011 03:01:48,Wednesday, February 02, 201
1 03:01:48, Thursday, February 03, 2011 03:01:51,Thursday, February 03, 2011 03:
01:51,Thursday, February 03, 2011 03:01:51, Friday, February 04, 2011 03:01:47,F
riday, February 04, 2011 03:01:47,Friday, February 04, 2011 03:01:47, Saturday,
February 05, 2011 03:00:10,Saturday, February 05, 2011 03:00:10,Saturday, Februa
ry 05, 2011 03:00:10, Sunday, February 06, 2011 03:00:08,Sunday, February 06, 20
11 03:00:08,Sunday, February 06, 2011 03:00:08, Monday, February 07, 2011 03:01:
51,Monday, February 07, 2011 03:01:51,Monday, February 07, 2011 03:01:52, Tuesda
y, February 08, 2011 03:01:46,Tuesday, February 08, 2011 03:01:46,Tuesday, Febru
ary 08, 2011 03:01:46, Wednesday, February 09, 2011 03:01:56,Wednesday, February
09, 2011 03:01:56,Wednesday, February 09, 2011 03:01:57, Thursday, February 10,
2011 03:01:43,Thursday, February 10, 2011 03:01:43,Thursday, February 10, 2011
03:01:43, Friday, February 11, 2011 03:01:50,Friday, February 11, 2011 03:01:50,
Friday, February 11, 2011 03:01:50, Saturday, February 12, 2011 03:00:09,Saturda
y, February 12, 2011 03:00:09,Saturday, February 12, 2011 03:00:09, Sunday, Febr
uary 13, 2011 03:00:06,Sunday, February 13, 2011 03:00:06,Sunday, February 13, 2
011 03:00:07, Monday, February 14, 2011 03:01:46,Monday, February 14, 2011 03:01
:46,Monday, February 14, 2011 03:01:47, Tuesday, February 15, 2011 03:01:45,Tues
day, February 15, 2011 03:01:45,Tuesday, February 15, 2011 03:01:45, Wednesday,
February 16, 2011 03:09:30,Wednesday, February 16, 2011 03:09:30,Wednesday, Febr
uary 16, 2011 03:09:31, Thursday, February 17, 2011 03:01:55,Thursday, February
17, 2011 03:01:55,Thursday, February 17, 2011 03:01:56, Friday, February 18, 201
1 03:01:58,Friday, February 18, 2011 03:01:58,Friday, February 18, 2011 03:01:58
, Saturday, February 19, 2011 03:09:09,Saturday, February 19, 2011 03:09:09,Satu
rday, February 19, 2011 03:09:09, Sunday, February 20, 2011 03:08:47,Sunday, Feb
ruary 20, 2011 03:08:47,Sunday, February 20, 2011 03:08:48, Monday, February 21,
2011 03:10:26,Monday, February 21, 2011 03:10:26,Monday, February 21, 2011 03:1
0:26, Tuesday, February 22, 2011 03:09:35,Tuesday, February 22, 2011 03:09:35,Tu
esday, February 22, 2011 03:09:35, Wednesday, February 23, 2011 03:09:15,Wednesd
ay, February 23, 2011 03:09:15,Wednesday, February 23, 2011 03:09:15, Thursday,
February 24, 2011 03:09:14,Thursday, February 24, 2011 03:09:14,Thursday, Februa
ry 24, 2011 03:09:14, Friday, February 25, 2011 03:09:24,Friday, February 25, 20
11 03:09:24,Friday, February 25, 2011 03:09:24, Saturday, February 26, 2011 03:0
9:09,Saturday, February 26, 2011 03:09:09,Saturday, February 26, 2011 03:09:09,
Sunday, February 27, 2011 03:09:01,Sunday, February 27, 2011 03:09:01,Sunday, Fe
bruary 27, 2011 03:09:01, Monday, February 28, 2011 03:09:35,Monday, February 28
, 2011 03:09:35,Monday, February 28, 2011 03:09:36, Tuesday, March 01, 2011 03:0
9:45,Tuesday, March 01, 2011 03:09:45,Tuesday, March 01, 2011 03:09:46, Wednesda
y, March 02, 2011 03:09:52,Wednesday, March 02, 2011 03:09:52,Wednesday, March 0
2, 2011 03:09:53, Thursday, March 03, 2011 03:09:40,Thursday, March 03, 2011 03:
09:40,Thursday...|'found files'=134;0;0

If I add debug=true it results in pages and pages of output. Below is a small portion if it, I hope it is enough.

d \parsers/filter/where_filter_impl.hpp(91) ==> Matched: Wednesday, July 20, 2011 02:30:08,Wednesday, July 20, 2011 02:30:08,Wednesday, July 20, 2011 02:30:09
d \parsers/filter/where_filter_impl.hpp(91) File pattern: c:\dir1\dir2\dir3\backup\Backup 2011-07-20\*.*
d \parsers/filter/where_filter_impl.hpp(91) Input is: c:\dir1\dir2\dir3\backup\Backup 2011-07-21 / 2010
d \parsers/filter/where_filter_impl.hpp(91) File pattern: c:\dir1\dir2\dir3\backup\Backup 2011-07-21\file.bck
d \parsers/filter/where_filter_impl.hpp(91) ==> Matched: Thursday, July 21, 2011 02:41:19,Thursday, July 21, 2011 02:41:19,Thursday, July 21, 2011 02:41:20
d \parsers/filter/where_filter_impl.hpp(91) File pattern: c:\dir1\dir2\dir3\backup\Backup 2011-07-21\*.*
d \parsers/filter/where_filter_impl.hpp(91) Input is: c:\dir1\dir2\dir3\backup\Backup 2011-07-22 / 2010
d \parsers/filter/where_filter_impl.hpp(91) File pattern: c:\dir1\dir2\dir3\backup\Backup 2011-07-22\file.bck
d \parsers/filter/where_filter_impl.hpp(91) ==> Matched: Friday, July 22, 2011 02:42:04,Friday, July 22, 2011 02:42:04,Friday, July 22, 2011 02:42:05
d \parsers/filter/where_filter_impl.hpp(91) File pattern: c:\dir1\dir2\dir3\backup\Backup 2011-07-22\*.*
d \parsers/filter/where_filter_impl.hpp(91) Input is: c:\dir1\dir2\dir3\backup\Backup 2011-07-23 / 2010
d \parsers/filter/where_filter_impl.hpp(91) File pattern: c:\dir1\dir2\dir3\backup\Backup 2011-07-23\file.bck

Message #2272

Use written instead of creation and iam pretty sure your problem is gone. I had the same problem and i think its a bug with creation.

btw, i would extend the filter with a second test for size: filter="written gt -1d and size gt 20g"

so it will go to crit if the file is smaller than 20g f.e. too.

rafael

08/12/11 16:44:24 (23 months ago)
- Message #2273
  
  Succes!
  
  Thanks Rafael, that solved my problem!
  
  And I will also use your tip on extending the filter with a size check ;)
  
  cre8tor
  
  08/12/11 19:59:49 (23 months ago)
  - Message #2276
    
    Under *nightly* there is a new build of 0.3.9 please see if that fixes this issue.
    
    Michael Medin
    
    mickem
    
    08/16/11 20:27:36 (22 months ago)

Tree View Flat View (newer first) Flat View (older first)

Subscriptions

Download in other formats:

RSS Feed