CheckFile2

A command to check aspects on several files it can be used to check one file but that is not the goal. The core scenario is: "do I have more then x files matching this criteria?" but it is flexible enough to be applicable in many other scenarios as well.

The main concept is much like the eventlog checks where you have a data-set which you want to "filter" and then check the resulting number of lines against a criteria.

Option	Values	Description
truncate		Truncate return data (not performance data)
ignore-perf-data	A boolean flag to disable returning performance data
syntax	%filename%	The syntax of how each file is presented, can include the following tokens: %path%, %filename%, %creation%, %access%, %write%, %size%, %version%, %line-count%
master-syntax	%list%	The syntax for the returned message %list% (the list of syntax strings), %matches% (number of matched files), %files% (number of files total)
path		The path to check from (root)
pattern		The file pattern to check
alias		Alias for the check
file		Deprecated (will be split into path and pattern)
debug		Boolean flag to enable debugging
ignore-errors		Boolean flag to ignore any errors
max-dir-depth		Recursion depth
filter	in,out,all,any	Filter mode (see below)

The CheckFile2 command Uses filters to define the "interesting" files.

Syntax

A filter is made up of three things:

• Filter mode Determines what happens when the filter is matched.
• Filter type What the filter will match (ie. which field).
• An Expression What to check for.

The syntax of a filter is: filter<mode><type>=<expression>

Order

Order is important, as soon as a positive (+) or negative (-) rule is matched it is either discarded or included and the entry is "finished" and it will continue with the next entry. The best way here is to have an "idea" either remove all entries first or include all required ones first (depending on what you want to do). You can mix and such but this will probably complicate things for you unless you actually need to.

Filter modes

Capturing files (or discarding them) are done with filters. There are three kinds of filters.

<filter mode>	title	description
+	positive requirements	All these filters must match or the row is discarded.
.	potential matches	If this matches the line is included (unless another lines overrides).
-	negative requirements	None of these filters can match (if any do the row is discarded).

Thus if you want to have: all files from the last month but not the ones smaller then 5kbI would break this down as such: (notice there are other options).

• date=older than 2 months

+ size=larget then 5k This would discard all files older then 2 month and then include all files larger then 5kb.

Filter Types

<filter type>	Values	Description
size	number	The size of the file
creation	time expression?	The date/time the file was created
written	time expression?	The date/time the file was last updated
accessed	time expression?	The date/time the file was last accessed
version	string expression?	The exe file version
line-count	number	Number of lines (in a text file)

time expression

A time expression is a date/time interval as a number prefixed by a filter prefix (<, >, =, <>) and followed by a unit postfix (m, s, h, d, w). A few examples of time expression are: filter+generated=>2d means filter will match any records older than 2 days, filter+generated=<2h means match any records newer then 2 hours. Warning, the bash interprets the "<,>,!". Use the "\" to avoid this. e.g. filter+generated=\>2d . On the Client activate the "Nasty Metachars" Option, to allow the \.

string expression

A string expression is a key followed by a string that specifies a string expression. Currently substr and regexp are supported. Thus you enter filter.message=regexp:(foo|bar) to enter a regular expression and filter-message=substr:foo to enter a substring patter match.

Filter in/out

There are two basic ways to filter:

• in When you filter in it means all records matching your filter will be returned (the "simplest way")
• out When you filter out it means all records matching your filter will be discarded.

So:

filter=in filter+size==5k
...
filter=out filter-size=ne:5k

Will both have the same effect as the first one filters "in" and matches all siles with 5kb and the second one filters out and discards all files not 5kb.

Sample Command:

CheckFile2 path=c:\test pattern=*.txt MaxCrit=1 filter+written=gt:2h

ok: CheckFile ok

Nagios Configuration:

define command {
  command_name <<CheckFile2>>
  command_line check_nrpe -H $HOSTADDRESS$ -p 5666 -c CheckFile2 -a path=$ARG1$ pattern=*.txt MaxCrit=1 filter+written=gt:$ARG2$
}
<<CheckFile2>> c:\test!2h

From Commandline (with NRPE):

check_nrpe -H IP -p 5666 -c CheckFile2 -a path=c:\test pattern=*.txt MaxCrit=1 filter+written=gt:2h

Some more Examples (for 0.3.8)

Sample Command:

CheckFile2 path=D:\tmp pattern=*.exe filter+version=!=1.0 "syntax=%filename%: %version%" MaxWarn=1

warning: WARNING:explorer.exe: 6.0.2900.5512

Nagios Configuration:

define command {
  command_name <<CheckFile2>>
  command_line check_nrpe -H $HOSTADDRESS$ -p 5666 -c CheckFile2 -a path=D:\tmp pattern=*.exe filter+version=!=1.0 "syntax=%filename%: %version%" MaxWarn=1
}
<<CheckFile2>> 

From Commandline (with NRPE):

check_nrpe -H IP -p 5666 -c CheckFile2 -a path=D:\tmp pattern=*.exe filter+version=!=1.0 "syntax=%filename%: %version%" MaxWarn=1

Sample Command:

CheckFile2 path=D:\tmp pattern=*.exe filter+version=!=6.0.2900.5512 "syntax=%filename%: %version%" MaxWarn=1

ok

Nagios Configuration:

define command {
  command_name <<CheckFile2>>
  command_line check_nrpe -H $HOSTADDRESS$ -p 5666 -c CheckFile2 -a path=D:\tmp pattern=*.exe filter+version=!=6.0.2900.5512 "syntax=%filename%: %version%" MaxWarn=1
}
<<CheckFile2>> 

From Commandline (with NRPE):

check_nrpe -H IP -p 5666 -c CheckFile2 -a path=D:\tmp pattern=*.exe filter+version=!=6.0.2900.5512 "syntax=%filename%: %version%" MaxWarn=1

Sample Command:

CheckFile2 path=D:\tmp pattern=*.txt filter+line-count=!=2 "syntax=%filename%: %line-count%" MaxWarn=1

warning: WARNING:test.txt: 3

Nagios Configuration:

define command {
  command_name <<CheckFile2>>
  command_line check_nrpe -H $HOSTADDRESS$ -p 5666 -c CheckFile2 -a path=D:\tmp pattern=*.txt filter+line-count=!=2 "syntax=%filename%: %line-count%" MaxWarn=1
}
<<CheckFile2>> 

From Commandline (with NRPE):

check_nrpe -H IP -p 5666 -c CheckFile2 -a path=D:\tmp pattern=*.txt filter+line-count=!=2 "syntax=%filename%: %line-count%" MaxWarn=1

Sample Command:

CheckFile2 path=D:\tmp pattern=*.txt filter+line-count=ne:3 "syntax=%filename%: %line-count%" MaxWarn=1

ok

Nagios Configuration:

define command {
  command_name <<CheckFile2>>
  command_line check_nrpe -H $HOSTADDRESS$ -p 5666 -c CheckFile2 -a path=D:\tmp pattern=*.txt filter+line-count=ne:3 "syntax=%filename%: %line-count%" MaxWarn=1
}
<<CheckFile2>> 

From Commandline (with NRPE):

check_nrpe -H IP -p 5666 -c CheckFile2 -a path=D:\tmp pattern=*.txt filter+line-count=ne:3 "syntax=%filename%: %line-count%" MaxWarn=1

Sample Command:

CheckFile2 path=D:\tmp pattern=*.txt filter+size=gt:20 "syntax=%filename%: %size%" MaxWarn=1

warning: WARNING:test.txt: 26B

Nagios Configuration:

define command {
  command_name <<CheckFile2>>
  command_line check_nrpe -H $HOSTADDRESS$ -p 5666 -c CheckFile2 -a path=D:\tmp pattern=*.txt filter+size=gt:20 "syntax=%filename%: %size%" MaxWarn=1
}
<<CheckFile2>> 

From Commandline (with NRPE):

check_nrpe -H IP -p 5666 -c CheckFile2 -a path=D:\tmp pattern=*.txt filter+size=gt:20 "syntax=%filename%: %size%" MaxWarn=1

Sample Command:

CheckFile2 path=D:\tmp\empty pattern=*.tx filter+size=gt:20 "syntax=%filename%: %size%" MaxWarn=1

ok

Nagios Configuration:

define command {
  command_name <<CheckFile2>>
  command_line check_nrpe -H $HOSTADDRESS$ -p 5666 -c CheckFile2 -a path=D:\tmp\empty pattern=*.tx filter+size=gt:20 "syntax=%filename%: %size%" MaxWarn=1
}
<<CheckFile2>> 

From Commandline (with NRPE):

check_nrpe -H IP -p 5666 -c CheckFile2 -a path=D:\tmp\empty pattern=*.tx filter+size=gt:20 "syntax=%filename%: %size%" MaxWarn=1

Sample Command:

CheckFile2 path=D:\tmp pattern=*.txt filter+size=gt:30 "syntax=%filename%: %size%" MaxWarn=1

ok

Nagios Configuration:

define command {
  command_name <<CheckFile2>>
  command_line check_nrpe -H $HOSTADDRESS$ -p 5666 -c CheckFile2 -a path=D:\tmp pattern=*.txt filter+size=gt:30 "syntax=%filename%: %size%" MaxWarn=1
}
<<CheckFile2>> 

From Commandline (with NRPE):

check_nrpe -H IP -p 5666 -c CheckFile2 -a path=D:\tmp pattern=*.txt filter+size=gt:30 "syntax=%filename%: %size%" MaxWarn=1

Sample Command:

CheckFile2 path=D:\tmp\empty pattern=*.tx filter+size=gt:30 "syntax=%filename%: %size%" MaxWarn=1 MaxCrit=4

ok

Nagios Configuration:

define command {
  command_name <<CheckFile2>>
  command_line check_nrpe -H $HOSTADDRESS$ -p 5666 -c CheckFile2 -a path=D:\tmp\empty pattern=*.tx filter+size=gt:30 "syntax=%filename%: %size%" MaxWarn=1 MaxCrit=4
}
<<CheckFile2>> 

From Commandline (with NRPE):

check_nrpe -H IP -p 5666 -c CheckFile2 -a path=D:\tmp\empty pattern=*.tx filter+size=gt:30 "syntax=%filename%: %size%" MaxWarn=1 MaxCrit=4