problem w/ check_log2.pl

[Andreas Ericsson]

Emmett Hogan wrote:
> Andreas Ericsson wrote:
> 
>> Emmett Hogan wrote:
>>
>>> Hi Folks,
>>>
>>> I am trying to use check_log2.pl via check_by_ssh to check for either 
>>> "WARNING" or "NOTICE"...however, if I use the command:
>>>
>>> check_by_ssh -l nagios -i nagios_key -H hostname -C 
>>> '/opt/nagios/libexec/check_log2.pl -l /var/adm/messages -s 
>>> /var/tmp/message.nagios-seek -p "WARNING|NOTICE"'
>>>
>>> It is treating the "|" as a unix pipe and not a regular expression 
>>> character.  I have tried every method of "escaping" the character, 
>>> but have had no luck.
>>> With all of the folks using check_log2.pl, I am sure someone has run 
>>> into this before....at least I hope so.
>>>
>>> Does anyone know of a solution?  (Maybe redefining the "or" character 
>>> for a PERL regular expression?)
>>>
>>
>> You need to do do double double-quotes of the regular expression, the 
>> inner of which must be escaped (as such):
>> blahblah "\"WARNING|NOTICE\""
>>
>> You can optionally use single qoutes on the outside and double quotes 
>> on the inside, or any manner of other method (triple escaping the 
>> pipe, for instance). It has to do with how the nrpe daemon executes 
>> commands.
> 
> 
> That's what I figured, but I have tried escaping, double quoting, etc.  
> but to no avail.  If it matters, I am using check_by_ssh, not nrpe. :-(
> 

It will pass through two shells. If you want to escape the pipe, you 
need to triple-escape it (escape one of the escapes as well).

Original command line: blahblah "\"WARNING|NOTICE\"" (ok)
when nagios runs the command: "WARNING|NOTICE" (still ok)
when ssh runs the command: WARNING|NOTICE (not ok).

Another example: WARNING\|NOTICE (ok)
When nagios runs it WARNING|NOTICE (not ok)

So we add a new level of escaping: WARNING\\|NOTICE (not ok)
The Original \ will escape the second one which will be interpreted 
literally, leaving the | unescaped.

So we try: WARNING\\\|NOTICE (ok)
When nagios runs it: WARNING\|NOTICE (ok)
When ssh runs it: WARNING|NOTICE (not ok)

So another level of escaping then. Each new 'end' level of escaping 
obviously requires to slashes, so that lands us with: 
WARNING\\\\\|NOTICE (ok)
nagios runs: WARNING\\\|NOTICE (ok)
SSH runs: WARNING\|NOTICE (ok)

So, a quintuple escape of the pipe would be what you need.

PS. Nagios actually runs the command with all the escapes. It's the 
shell (which is always invoked when using the popen() call) that removes 
them (uses them, really) as they go along.

-- 
Andreas Ericsson                   andreas.ericsson at op5.se
OP5 AB                             www.op5.se
Lead Developer


-------------------------------------------------------
The SF.Net email is sponsored by: Beat the post-holiday blues
Get a FREE limited edition SourceForge.net t-shirt from ThinkGeek.
It's fun and FREE -- well, almost....http://www.thinkgeek.com/sfshirt
_______________________________________________
Nagios-users mailing list
Nagios-users at lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/nagios-users
::: Please include Nagios version, plugin version (-v) and OS when reporting any issue. 
::: Messages without supporting info will risk being sent to /dev/null