Ep. 22: Monitoring logfiles with Checkmk
Read Video Transcript
|[0:00:00]||Hello, my name is Bastian. And today I'm going to show you how to monitor log files.|
|[0:00:16]||The logwatch plugin works for Unix and Windows. But only difference is on Windows you're going to get the event logs, while on Unix systems to configure your own log files.|
|[0:00:30]||Of course, you can monitor your own log files also on windows. But technically speaking, it's not log watch behind. Let's look into the configuration.|
|[0:00:41]||From Setup, we go into the part Agents, which is basically the ancient bakery. And even we don't use the roll out feature of the ancient bakery, we're going to use it to download the agent manually.|
|[0:01:00]||Therefore, we change to Agent rules and filter for log. There we have text log files which we can use for Linux, Unix in general and for Windows.|
|[0:01:22]||We create a new rule. Everything is like we know from the rule-based configuration system. We basically need to decide that we want to deploy the plugin. And we need to set the default configuration.|
|[0:01:45]||That means we need to specify the log files we want to monitor. We can do, of course, multiple of them.|
|[0:02:06]||And finally, we need to add some patterns. For example, we want to have everything starting with error and other stuff starting with warning.|
|[0:02:31]||This, of course, are only examples for me to show you to plug in. Normally, you would add the patterns you want to monitor from your log files here. Now we just need to save it.|
|[0:02:47]||Go back to the agents. Click to Bake agents. Now it takes some seconds.|
|[0:03:03]||And finally, we can download our installation package with the agent and the log file plugin. Then let's install the new agent. At first, I need to copy this agent to my server.|
|[0:03:32]||Then I need to log on to this server and install it. If the encryption node is enabled, I can do a quick test and can even see in the output that I get information about at least one log file. Next step is we do the discovery.|
|[0:04:10]||Since we added this new plugin, we need to discover it, of course, for our host. For that, I can directly use this icon.|
|[0:04:22]||This saves me some clicks if I just go to edit and then to the services. It's basically one click more. Checkmk already found my syslog here.|
|[0:04:34]||I'm using Fix all to add it and I'm gonna activate my changes. Let's open my host. The new server is still expanding. I'm not patient so I trigger it for not waiting.|
|[0:05:04]||No error messages yet. But let's change that. Back to the command line. For testing, I know I'm gonna generate some log events. I'm gonna use the tool logger for that and I remember my pattern with error Something wrong.|
|[0:05:33]||And that's it. Already, I can double check it in the log file. There we have it. And the next should be Checkmk to find it.|
|[0:05:52]||There it is. One error, one critical message. And what we now need to do is to open the burger menu here. Go to Open log and we can see our log file.|
|[0:06:12]||To get a new notification,. the next thing we need to do is to click Clear log. And now Checkmk is ready to receive new errors.|
|[0:06:27]||One little thing you need to know if you monitor Windows, you're gonna get all the event logs of Windows. And since you can't configure patterns on the windows agent for the event log, you are able to configure log file patterns also in the Setup.|
|[0:06:44]||I'm going to show you how. We go into Setup. We search for log file and we're going to find log file patterns. These are normal rules, which you can create in folders, which you can assign to hosts or even to log files.|
|[0:07:06]||And here you can add patterns to reclassify the messages you get from the agent. For example, I can say, if something starts with Test, it should be OK. But it's something with error again.|
|[0:07:27]||For the example, it should be critical. I'm going to save that. And now another little helper comes in handy, it's the pattern analyzer.|
|[0:07:41]||With this analyzer, you can test your rules. So, you can copy your log file line to here, for example, a line like "Test is good". Try out and you're going to see that this line will match. "Error is bad". Try out.|
|[0:08:06]||And you see this line is going to match. This comes especially in handy with the windows syslogs. There you cannot change the patterns on the agent side so you need to do it here.|
|[0:08:21]||And a little tip, if you want to add patterns for Windows log files, best would be to use the IDs which you're going to see on the front of the log message. A little thing here about the IDs I want to show. If you build a rule, say, I want to ignore the ID like 0815.|
|[0:08:49]||And I'm going to save it. I go back to the analyzer and I'm going to test 0815. It works. But, since we have a regex, also this part will match.|
|[0:09:08]||So therefore, a little extra tip: use the power of regex and just add an empty sign at the back and maybe in case of the syslogs from windows even in the front. Because normally you're gonna have text in front. And another little helpful part is the comment section here.|
|[0:09:35]||If you just have numbers for the patterns in a year, you don't gonna know what this number even means. So, I would recommend also adding a comment here. So,we save it again, back to the analyzer.|
|[0:09:50]||I try again white space in this case, or "something <number> else'. Try out. We have a match. Now we add the six here and don't have a match anymore. That's it for the logfile monitoring.|
|[0:10:12]||I hope you enjoy it and see you in the next video.|
More Checkmk Videos
Ep. 1: Installing Checkmk 2.0 and monitoring your first host
In this video, Baris explains how to take get started with Checkmk and start monitoring your first host within a few minutes.
Ep. 2: The Checkmk 2.0 user interface
In this video, Baris take you through the new user interface in Checkmk 2.0. He explains the various components of the User interface such as the new navigation menus, the Sidebar, main dashboard, tactical overview, how to switch between the Checkmk interface themes and much more
Ep. 3: Using SNMP to monitor network devices in Checkmk 2.0
In this episode, Baris explains how to monitor network devices with Checkmk. SNMP is a protocol that many switches, routers, printers, UPSs, hardware sensors and other devices have implemented with the purpose of being able to monitor them easily.
Ep. 4: Monitoring Windows in Checkmk
In this video of our Getting started with Checkmk series, Baris explains how to install a Checkmk agent on a Windows host system and add that into your monitoring environment.
Ep. 5: Using metrics and graphs in Checkmk 2.0
In the 5th episode of the Getting started with Checkmk series, Baris explains using various metrics that you can monitor in Checkmk such as CPU utilization, CPU load etc. You can also see graph visualizations for these metrics or create and customize your own as per your requirements.
Ep. 6: Updating Checkmk 2.0 and using multiple instances
In this video, Baris explains how to update your Checkmk instance. It is very easy and can be done within minutes. You can run multiple Checkmk instances with different versions on the same system. This gives you the flexibility to test the new version before using it in production.
Ep. 7 (part 1): Working with rules and setting thresholds in Checkmk
In the following three-part videos series, Baris explains rule-based monitoring with Checkmk. In the first part, he shows you how you can work with rules and set threshold values. Rule-based configuration is one of the key features for Checkmk which helps you to scale your monitoring easily within minutes.
Ep. 7 (part 2): Smart rules with Host Tags in Checkmk
In the second part of this video, Baris explains using Smart rules with host tags in Checkmk. In the first part, he shows you how you can work with rules and set threshold values. These are features that you can use to build your rules even more intelligently and to better organize your monitoring.
Ep. 7 (part 3): Managing Hosts in Folder in Checkmk
In this final part of our episode on Rule-based monitoring in Checkmk, Baris demonstrates how to manage hosts in folders in Checkmk. This helps you to apply your monitoring configurations at scale and organize your hosts according to your needs.
Ep. 8: Working with Host and Service Groups in Checkmk
In this Baris demonstrates how to create host and service groups in Checkmk, so you can perform actions on an entire group instead of configuring each of them individually.
Ep. 9: Using the Quicksearch function in Checkmk
In this episode of the Checkmk tutorials, Baris shows how you can use the Quicksearch function in Checkmk. You can use it to easily find and manage certain hosts or services. He also explains some examples of filters to you. In Checkmk 2.0 you can use the same syntax in the Seach function found in the monitor menu to get identical results.
Ep. 10: Detecting configuration errors with the Analyze Configuration feature
With the Analyze Configuration feature, you can check if there are any configuration errors in your installation. Checkmk controls a number of possible security risks or potential performance restrictions and indicates if there are any problems.
Ep. 11: View creation and customization in Checkmk
In this video, Baris demonstrates how to customize headers, columns, and more in Views in Checkmk for yourself or other users. He also explains how to create custom views and add desired information to these views.
Ep. 12: Acknowledging problems in Checkmk
In this video, Baris explains how you can acknowledge problems in Checkmk. This function helps you to qualify the states of hosts and services. This allows you to keep track of messages in the main dashboard and, for example, you can add comments to problems.
Ep. 13: Scheduling downtimes in Checkmk
In the episode of our Getting started with Checkmk series, Baris explains how you can manage the maintenance times of your systems in Checkmk. Such scheduled downtimes prevent your monitoring from sending false alarms when a host or service goes to WARN or CRIT during maintenance work. You can also inform the users concerned about the maintenance via Checkmk.
Ep. 14: Distributed monitoring with Checkmk
In this video, Baris explains how you can connect several Checkmk instances to a monitoring system and then manage it.
Ep. 15: MKPs and Plugins in Checkmk
In the 15th episode of our Getting started with Checkmk tutorial series, Baris explains what are Checkmk Extension Packages (MKPs) and how easy it is to integrate them into your Checkmk monitoring environment. MKPs are the preferred format when you make your own extensions as it makes it easy to share with other users or deploy in distributed environments.
Ep. 16: Working with 'Bulk Actions' in Checkmk
In this episode of our Checkmk tutorials series, Baris explains how you can save a lot of time with bulk actions. With this feature you can perform various tasks such as deleting, renaming, service discovery etc. on a large number of hosts simultaneously.
Ep. 17: Working with network topologies in Checkmk
In this video of our gettign startted with Checkmk series, Baris explains how to map network topologies in Checkmk. This feature is quite helpful to manage your network and prevent any unnecessary notifications from the devices in your network.
Ep. 18: Creating and customizing dashboards in Checkmk
In this video of our Getting started with Checkmk series, Mathias explains how you can create and customize dashboards in Checkmk 2.0, so you can get insights into your monitoring according to your requirements. Find out more in this video.
Ep. 19: Monitoring websites and their certificates with Checkmk
In this episode, Bastian demonstrates how to monitor a website and its certificate with Checkmk. You can also monitor specific web pages with Checkmk by using the several options that will suit your use case. Learn more in this video.
Ep. 20: Configuring dashboard elements in Checkmk
Learn how to add data visualization elements of the various metrics into your Checkmk Dashboard. In this video, Mathias explains how you can configure these elements and create a dashboard as per your requirements.
Ep. 21: Setting up notifications in Checkmk
Learn how to set up notifications in Checkmk and assign relevant contacts and contact groups to be notified for various events. Later in this video, our presenter Bastian also demonstrates how you can set up rule-based notifications according to different conditions for hosts and services.
Ep. 24: 3 Rules for efficient network monitoring
In this video, Bastian demonstrates 3 rules that will help you to efficiently monitor your network interfaces. With Checkmk 2.0, with just three rules, you can set up an efficient network monitoring that will not only monitor all of your network interfaces but also simultaneously provide a detailed overview of all of your ports.
Ep. 25: New UX and security improvements in Checkmk 2.1
Checkmk 2.1 come with many UX improvements such as pre-built dashboards for Linux and Windows, faster core performance and much more. Security features such as two-factor authentication etc. were also added in this new version. Watch this video to learn how to use these new features and enhancements in Checkmk.
Ep. 28: Working with InfluxDB integration in Checkmk
Learn how to send data to InfluxDB from Checkmk. As InfluxDB introduced a new protocol to send data to it, a new connector was developed with Checkmk to talk natively with it. Learn more about it in this video.
Ep. 29: New agent architecture in Checkmk 2.1
With Checkmk 2.1, the agent architecture was modified to enable performance improvements and add new features such as TLS encryption, data compression, and the reversal of direction of communication from the agent. This will enable push mode and pull mode.
Ep. 30: Clustering the Checkmk appliance
In this video, Robin demonstrates how you can cluster your Checkmk appliance to make it resilient against hardware failures. If you are using the Checkmk hardware appliance, it may be helpful to cluster your appliance to maintain high availability.
Ep. 32: Working with the Agent bakery in Checkmk
In this video, Robin demonstrates how to roll out agent packages with the required configuration for different monitored systems using the agent bakery in Checkmk. The "Automatic agent update" is quite a helpful feature as it pulls the latest configurations for an agent automatically and you don't need to manually update all of your agents deployed on different systems.
Ep 33: Monitoring Docker containers with Checkmk
Learn how to monitor Docker containers with Checkmk.In this video, Robin demonstrates the process of setting up a rule to configure the docker plugin and bake an agent with the desired settings for the Docker host.
Ep 34: Introduction to Checkmk Ansible collection
Last year the Checkmk Ansible collection was created to interact with the Checkmk REST API. In this video, Robin demonstrates how you can use this Ansible collection to automate your monitoring with Checkmk.
Ep 35: Monitoring SQL databases with Checkmk
In this video, Robin demonstrates how you can configure your Checkmk site to monitor your SQL databases. As there are many flavours of SQL databases, the process is mostly the same.