CheckFile2

[jussi]

Following command returns wrong file modified date:

CheckFile2 -a path="f:
windowsimagebackup
backup" pattern=*.vhd filter=in filter+written=\<"20h" syntax="%filename% was modified %write%" MinWarn=0 max-dir-depth=1

ee7fd900-a453-11df-a240-0017a477c432.vhd was modified Wednesday, February 16, 2011 18:57:21|'found files'=1;0;0

Actual modified date was 2 hours later.

Is there something wrong with my syntax?

[mickem]

What timezone are you in?
I noticed recently the times (atleast for the new command) was in UTC meaning timezones could mess with this. IN general I would recomend trying the same with the new CheckFiles command:

CheckFiles -a path="f:\\windowsimagebackup\\backup" pattern=*.vhd filter=written < -20h" syntax="%filename% was modified %written%" MinWarn=0 max-dir-depth=1

With the latest nightly if possible.
If not please run the existing command with debug and see what the debug log says (it should print the time and the relative "now" as well I think.

Michael Medin

[iso00]

I tried the nightly build NSClient++-0.3.9-Win32-20110216-2242 after running into same bug on 0.3.7 and 0.3.8

./check_nrpe -H hostname -p 5666 -c CheckFiles -a path=f:\Backup pattern=*.bkf "filter=written lt -24h" MaxCrit=1 "syntax=Backup (%filename%): %size% %write%"

Command returns last written as Wednesday, February 23, 2011 08:15:58
Actual last written is Wednesday, February 23, 2011 03:15:58

I'm EST (UTC -05:00)

[iso00]

CheckFiles on 0.3.9 nightly also doesn't seem to process the filter properly. I'll have filter="written lt -24h" which matches on files older than 24 hours however the check returns critical with a file that has been modified less than 24 hours ago. It will return a critical result no matter what value you substitute -24h with. This filter logic seems to work fine in 0.3.6 using the checkfile2 function.

/usr/local/nagios/libexec > ./check_nrpe -H myserver01 -p 5667 -c CheckFiles -a path=F:/Backup pattern=*.bkf filter="written lt -1000000d" MaxCrit=1 "syntax=Backup (%filename%): %size% %write%"
Backup (Backup.bkf): 606M Thursday, February 24, 2011 08:15:59, found files: 1 > critical|'found files'=1;0;1

[mickem]

Well... forst off the UTC thingy this is a "known issue" the time reported is UTC (IIRC) but the check is run in the "same time zone" so the check should be correct I think.

But since you have troubles I shall investigate... maybe something is broken...

Michael Medin