The check tests two things: whether the log file was modified within a time window and whether a pattern occurs in it. It is typically used for backup logs.
| Property | Value |
|---|---|
| Type identifier | log_file |
| Runner | Agent |
| Target in the email | Log path |
| Field | Key | Default | Meaning |
|---|---|---|---|
| Log file path | log_path |
Required. Absolute path of the log file | |
| Pattern | pattern |
Required. Plain text or regular expression that must occur in the file | |
| Max age | max_age_minutes |
1440 (1 day) |
FAIL if the file has not been modified for longer. Entered in days, hours and minutes |
A pattern counts as a regular expression when it starts with / and ends with / plus optional modifiers, for example /status=OK.*duration=\d+s/. Anything else is searched as literal text.
The path is prefixed with HOST_ROOT when the variable is set in the agent. The check tests the age first and the pattern second.
| Situation | Status | Message |
|---|---|---|
| File not too old, pattern found in a line | OK |
Pattern matched in <path> |
| File missing | FAIL |
Log file not found: <path> |
| File older than the time window | FAIL |
Log file is <n> min old (max: <m> min): <path> |
| Pattern not found | FAIL |
Pattern not found in <path>: <pattern> |
| File not readable | FAIL |
Cannot read file: <resolved path> or Cannot read mtime of <resolved path> |
| Invalid or catastrophically slow regular expression | UNKNOWN |
Invalid pattern or catastrophically slow regex: <pattern> |
| No path or no pattern | UNKNOWN |
No log_path configured or No pattern configured |
The messages for a missing file, age and pattern show the configured path, for example
/var/log/backup.log. The read-error messages instead contain the resolved path with theHOST_ROOTprefix, for example/host/root/var/log/backup.log.
The check reads the whole file and searches all lines, not just the end. An old match is enough as long as the file itself is recent. Very large files are read into memory completely.