Sensu Plugins Logs Plugin

• Overview
• Files
• Usage examples
• Configuration
  • Sensu Go
    • Asset registration
    • Asset definition
    • Check definition
  • Sensu Core
    • Check definition
• Installation from source
• Additional notes
• Contributing

Overview

This plugin provides native instrumentation for monitoring log files or system logs via journald for regular expressions and a Sensu handler for logging Sensu events to log files.

Files

• bin/check-journal.rb
• bin/check-log.rb
• bin/handler-logevent.rb
• bin/handler-show-event-config.rb

check-journal Checks the systemd journal (journald) for a pattern.

check-log Checks a log file for a regular expression, skipping lines that have already been read. Stores the number of bytes read and seeks to that position next time (instead of making a backup copy of the whole log file).

handler-logevent Logs last settings['logevent']['keep'] JSON events in files as settings['logevent']['eventdir']/client/check_name/timestamp.action.

handler-show-event-config Lists the handler's config and the event it read.

Usage examples

Help

check-journal.rb

Usage: check-journal.rb (options)
    -c, --critical COUNT             Number of matches to consider a critical issue.
    -j "ARGS1 ARGS2 ...",            Pass additional arguments to journalctl, eg: "-u nginx.service"
        --journalctl_args
    -q, --pattern PAT                Pattern to search for
    -s, --since TIMESPEC             Query journal entries on or newer than the specified date/time.
    -v                               Verbose output. Helpful for debugging the plugin.
    -w, --warning COUNT              Number of matches to consider a warning    

handler-logevent.rb

Usage: handler-logevent.rb (options)
        --map-go-event-into-ruby     Enable Sensu Go to Sensu Ruby event mapping. Alternatively set envvar SENSU_MAP_GO_EVENT_INTO_RUBY=1.

Configuration

Sensu Go

Asset registration

Assets are the best way to make use of this plugin. If you're not using an asset, please consider doing so! If you're using sensuctl 5.13 or later, you can use the following command to add the asset:

sensuctl asset add sensu-plugins/sensu-plugins-logs

If you're using an earlier version of sensuctl, you can download the asset definition from this project's Bonsai asset index page.

Asset definition

---
type: Asset
api_version: core/v2
metadata:
  name: sensu-plugins-logs
spec:
  url: https://assets.bonsai.sensu.io/9ba6c6b27b5ca36538de3a13f014718ead3a1215/sensu-plugins-logs_4.0.0_centos_linux_amd64.tar.gz
  sha512: 4e29c549924b5df01c7a8e0ed105659b3e9e81ca5c919548efd03a2ccaaf83d8605130ab80132e93db6f5e25c7acddbd7f6e8c6d185567eb5f73cd420dcc2f06

Check definition

---
type: CheckConfig
spec:
  command: "check-journal.rb"
  handlers: []
  high_flap_threshold: 0
  interval: 10
  low_flap_threshold: 0
  publish: true
  runtime_assets:
  - sensu-plugins/sensu-plugins-logs
  - sensu/sensu-ruby-runtime
  subscriptions:
  - linux

Handler definition

handler-logevent

{
  "logevent": {
    "eventdir": "/var/log/sensu/events",
    "keep": 10
  }
}

Sensu Core

Check definition

{
  "checks": {
    "check-journal": {
      "command": "check-journal.rb",
      "subscribers": ["linux"],
      "interval": 10,
      "refresh": 10,
      "handlers": ["influxdb"]
    }
  }
}

Installation from source

Sensu Go

See the instructions above for asset registration.

Sensu Core

Install and setup plugins on Sensu Core.

Additional notes

Sensu Go Ruby Runtime Assets

The Sensu assets packaged from this repository are built against the Sensu Ruby runtime environment. When using these assets as part of a Sensu Go resource (check, mutator, or handler), make sure to include the corresponding Sensu Ruby Runtime Asset in the list of assets needed by the resource.

Use this plugin with Sensu Go

To use the included handlers with Sensu Go, use the --map-go-event-into-ruby argument or set environment variable SENSU_MAP_GO_EVENT_INTO_RUBY=1.

Make sure the required handler configuration JSON exists under /etc/sensu/conf.d/ or at a path in the colon-separated list of files in the environment variable SENSU_CONFIG_FILES.

Contributing

See CONTRIBUTING.md for information about contributing to this plugin.