Uniquely Identifiable Events in Nagios.log?

[Andreas Ericsson]

Christopher McAtackney wrote:
> Hi all,
> 
> I was wondering if it is possible to configure Nagios to produce
> uniquely identifiable entries in the nagios/var/nagios.log file?
> 
> The reason I ask, is that I would like to parse this log file for
> service check results and perform further processing based on the
> values discovered there. The trouble is, that as far as I can see,
> Nagios uses a time-stamp which is only accurate to the second, and so
> my log files have lines which all have the same time-stamp. Is there a
> way to increase the accuracy of this time-stamp perhaps? Or any other
> suitable solution to the general problem of identifying log entries?
> 

Since you almost certainly want to maintain a single process to handle
the logged lines, why not just write a tail-like program that parses
them one by one as they're written? After all, you'd hardly want to
slog through all the log-entries multiple times anyway.
With this solution, I find it hard to see a need for uniqueness. should
it happen that you still want to be able to uniquely identify lines, I
believe a hash over the last 15 or so lines should suffice, assuming
it's sufficiently strong (say, SHA1 or something). The chance of running
into a collision should be very slim, and if it happens you can just
increase the number of hashed lines.

-- 
Andreas Ericsson                   andreas.ericsson at op5.se
OP5 AB                             www.op5.se
Tel: +46 8-230225                  Fax: +46 8-230231

Considering the successes of the wars on alcohol, poverty, drugs and
terror, I think we should give some serious thought to declaring war
on peace.

------------------------------------------------------------------------------
_______________________________________________
Nagios-users mailing list
Nagios-users at lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/nagios-users
::: Please include Nagios version, plugin version (-v) and OS when reporting any issue. 
::: Messages without supporting info will risk being sent to /dev/null