problem w/ check_log2.pl

[Emmett Hogan]

Andreas Ericsson wrote:

> Emmett Hogan wrote:
>
>> Andreas Ericsson wrote:
>>
>>> Emmett Hogan wrote:
>>>
>>>> Hi Folks,
>>>>
>>>> I am trying to use check_log2.pl via check_by_ssh to check for 
>>>> either "WARNING" or "NOTICE"...however, if I use the command:
>>>>
>>>> check_by_ssh -l nagios -i nagios_key -H hostname -C 
>>>> '/opt/nagios/libexec/check_log2.pl -l /var/adm/messages -s 
>>>> /var/tmp/message.nagios-seek -p "WARNING|NOTICE"'
>>>>
>>>> It is treating the "|" as a unix pipe and not a regular expression 
>>>> character.  I have tried every method of "escaping" the character, 
>>>> but have had no luck.
>>>> With all of the folks using check_log2.pl, I am sure someone has 
>>>> run into this before....at least I hope so.
>>>>
>>>> Does anyone know of a solution?  (Maybe redefining the "or" 
>>>> character for a PERL regular expression?)
>>>>
>>>
>>> You need to do do double double-quotes of the regular expression, 
>>> the inner of which must be escaped (as such):
>>> blahblah "\"WARNING|NOTICE\""
>>>
>>> You can optionally use single qoutes on the outside and double 
>>> quotes on the inside, or any manner of other method (triple escaping 
>>> the pipe, for instance). It has to do with how the nrpe daemon 
>>> executes commands.
>>
>>
>>
>> That's what I figured, but I have tried escaping, double quoting, 
>> etc.  but to no avail.  If it matters, I am using check_by_ssh, not 
>> nrpe. :-(
>
>
> So another level of escaping then. Each new 'end' level of escaping 
> obviously requires to slashes, so that lands us with: 
> WARNING\\\\\|NOTICE (ok)
> nagios runs: WARNING\\\|NOTICE (ok)
> SSH runs: WARNING\|NOTICE (ok)
>
> So, a quintuple escape of the pipe would be what you need.

Well....it turned out to be a combination of the two solutions...using 
single quotes AND escaping the pipe (but just once)...

check_by_ssh -l user -i ../.ssh/identity -H hostname -C 
"/opt/nagios/libexec/check_log2.pl -l /var/adm/messages -s 
/var/tmp/message.nagios-seek -p 'WARNING\|NOTICE'"

That's double quotes around the whole command and single quotes around 
the regex, with the pipe escaped.

Sheesh! :-)

Thanks for the help!

-Emmett


-- 
================ Examen, Inc. ================
Emmett Hogan
Senior UNIX Administrator
emmetth at examen.com
==== Outside Counsel Management Solutions ====

CONFIDENTIAL -  PRIVILEGED INFORMATION
This e-mail may include confidential, trade secret or legally
privileged information.  If you are not the intended recipient,
please do not read, copy, use, distribute or disclose this
communication to anyone other than the intended recipient. Please
notify the sender of any error in transmission or delivery and
delete any misdirected e-mail from your system.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: EmmettH.vcf
Type: text/x-vcard
Size: 260 bytes
Desc: not available
URL: <https://www.monitoring-lists.org/archive/users/attachments/20050105/e15c27e0/attachment.vcf>