CheckFiles

Requires 0.3.9 This is a replacement for CheckFile and CheckFile2.

A command to check aspects on several files it can be used to check one file but that is not the goal. The core scenario is: "do I have more then x files matching this criteria?" but it is flexible enough to be applicable in many other scenarios as well.

Option	Values	Description
truncate		Truncate return data (not performance data)
ignore-perf-data	A boolean flag to disable returning performance data
syntax	%filename%	The syntax of how each file is presented, can include the following tokens: %path%, %filename%, %creation%, %access%, %write%, %size%, %version%, %line-count%
master-syntax	%list%	The syntax for the returned message %list% (the list of syntax strings), %matches% (number of matched files), %total% (number of files total) and %status%
path		The path to check from (root), path can be specified using both \ and / syntax, the latter might be simpler to use remotely as it does not require nasty meta chars. When checking Windows shares the nscp might need to be started as a domain user.
pattern		The file pattern to check
alias		Alias for the check
file		Deprecated (will be split into path and pattern)
debug		Boolean flag to enable debugging
ignore-errors		Boolean flag to ignore any errors
max-dir-depth		Recursion depth
filter	The filter string (see below)
MaxWarn	number of records	The maximum records to allow before reporting a warning state.
MaxCrit	number of records	The maximum records to allow before reporting a critical state.
warn	number of records	The maximum records to allow before reporting a warning state. This is the exact version where you have more control then the Max/MinWarn? equivalent.
crit	number of records	The maximum records to allow before reporting a critical state. This is the exact version where you have more control then the Max/MinWarn? equivalent.

The CheckFiles command Uses filters to define the "interesting" files.

Syntax

The syntax is much like SQL where clauses for details on the syntax see the filters page.

Order

Order is somewhat important but mainly in the fact that some operations are more costly then others. For instance line_count requires us to read and count the lines in each file so choosing between the following:

filter=create < -2d and line_count > 100

filter=line_count > 100 and create < -2d

The first one will be significantly faster if you have a thousand old files and 3 new ones. But looking at the following:

filter=create < -2d and size > 100k

Swapping them would not be noticeable.

Filter Variables

<filter variable>	Values	Description
size	number	The size of the file
creation	time_expression?	The date/time the file was created
written	time_expression?	The date/time the file was last updated
access	time_expression?	The date/time the file was last accessed
version	string_expression?	The exe file version
line_count	number	Number of lines (in a text file)

time expression

A time expression is a date/time interval as a number followed by a unit postfix (m, s, h, d, w). A few examples of time expression are: generated < -2d translates to older then 2 days where as generated > -2h means match any records newer then 2 hours. Warning, the bash shell on linux interprets the "<,>,!". Use the "\" to avoid this. e.g. generated=\>2d and activate the nasty meta chars option. The new method avoids problems with escape characters and nasty meta chars. Replace > with gt and < with lt, e. g.: generated lt -2d.

Minus versus no minus:

• Affects "what you compare to"
• -15m will create a comparison point which is "15 minutes ago"
• 15m will create a comparison point which is 15 minutes in the future.

And gt versus lt:

• Affects "how you compare" (older versus newer)
• less then means "older then"
• greater then means "newer then"

In essence the "times" are converted to numbers representing the number of seconds (or microseconds or some such) (in UTC BTW) since <whatever>. So small number means "old file" large number means "new file".

string expression

A string expression is a key followed by a string that specifies a string expression. Example: version = '1.0.0.0'

Some more Examples (for 0.3.9)

Checking file versions

Sample Command:

CheckFiles path=D:/tmp pattern=*.exe "filter=version != 1.0" "syntax=%filename%: %version%" MaxWarn=1

warning: WARNING:explorer.exe: 6.0.2900.5512

Nagios Configuration:

define command {
  command_name <<CheckFiles>>
  command_line check_nrpe -H $HOSTADDRESS$ -p 5666 -c CheckFiles -a path=D:/tmp pattern=*.exe "filter=version != 1.0" "syntax=%filename%: %version%" MaxWarn=1
}
<<CheckFiles>> 

From Commandline (with NRPE):

check_nrpe -H IP -p 5666 -c CheckFiles -a path=D:/tmp pattern=*.exe "filter=version != 1.0" "syntax=%filename%: %version%" MaxWarn=1

Checking file versions using exact bound

Sample Command:

CheckFiles path=D:/tmp pattern=*.exe "filter=version != 1.0" "syntax=%filename%: %version%" warn=gt:1 crit==1

warning: WARNING:explorer.exe: 6.0.2900.5512

Nagios Configuration:

define command {
  command_name <<CheckFiles>>
  command_line check_nrpe -H $HOSTADDRESS$ -p 5666 -c CheckFiles -a path=D:/tmp pattern=*.exe "filter=version != 1.0" "syntax=%filename%: %version%" warn=gt:1 crit==1
}
<<CheckFiles>> 

From Commandline (with NRPE):

check_nrpe -H IP -p 5666 -c CheckFiles -a path=D:/tmp pattern=*.exe "filter=version != 1.0" "syntax=%filename%: %version%" warn=gt:1 crit==1

Using the line count with limited recursion

Sample Command:

CheckFiles path=D:\windows pattern=*.txt max-dir-depth=1 "filter=line_count gt 100" "syntax=%filename%: %line_count%" MaxWarn=1

warning: WARNING:test.txt: 3

Nagios Configuration:

define command {
  command_name <<CheckFiles>>
  command_line check_nrpe -H $HOSTADDRESS$ -p 5666 -c CheckFiles -a path=D:\windows pattern=*.txt max-dir-depth=1 "filter=line_count gt 100" "syntax=%filename%: %line_count%" MaxWarn=1
}
<<CheckFiles>> 

From Commandline (with NRPE):

check_nrpe -H IP -p 5666 -c CheckFiles -a path=D:\windows pattern=*.txt max-dir-depth=1 "filter=line_count gt 100" "syntax=%filename%: %line_count%" MaxWarn=1

Check file sizes

Sample Command:

CheckFiles path=D:\tmp pattern=*.txt "filter=size gt 20" "syntax=%filename%: %size%" MaxWarn=1

warning: WARNING:test.txt: 26B

Nagios Configuration:

define command {
  command_name <<CheckFiles>>
  command_line check_nrpe -H $HOSTADDRESS$ -p 5666 -c CheckFiles -a path=D:\tmp pattern=*.txt "filter=size gt 20" "syntax=%filename%: %size%" MaxWarn=1
}
<<CheckFiles>> 

From Commandline (with NRPE):

check_nrpe -H IP -p 5666 -c CheckFiles -a path=D:\tmp pattern=*.txt "filter=size gt 20" "syntax=%filename%: %size%" MaxWarn=1