Werk #15307: logwatch_ec: tcp remote forwarding: create one spool file per service

Component Checks & agents
Title logwatch_ec: tcp remote forwarding: create one spool file per service
Date Nov 13, 2023
Level Trivial Change
Class Bug Fix
Compatibility Compatible - no manual interaction needed
Checkmk versions & editions
2.3.0b1 Checkmk Raw (CRE), Checkmk Enterprise (CEE), Checkmk Cloud (CCE), Checkmk MSP (CME)
2.2.0p15 Checkmk Raw (CRE), Checkmk Enterprise (CEE), Checkmk Cloud (CCE), Checkmk MSP (CME)
2.1.0p37 Checkmk Raw (CRE), Checkmk Enterprise (CEE), Checkmk MSP (CME)

This Werk affects you if you have a logwatch_ec check which forwards events to a remote syslog hosts and if you activated the option "Create a separate check for each logfile".

In this case all separate services shared one spoolfile. This lead to the problem, that one event in the spoolfile was displayed as one event for each separate service (but it was only sent out once, when the remote was reachable again).

In some conditions events might been unnoticeable dropped, because the spoolfile was overwritten by another logwatch service.

Now each logwatch service will have their own spoolfile.

The spoolfiles will be automatically assigned to their logwatch service.

After all your logwatch_ec services sent all their spoolfiles out, you may manually consult the following folder for spoolfile.* files:

./var/check_mk/logwatch_spool/<hostname>

If there are any spoolfiles in this folder, they could not be assigned to a logwatch service. If you still want them to be forwarded, move them to one of the folders, otherwise they can be deleted.

./var/check_mk/logwatch_spool/<hostname>/item_<url_encode(item)>

To the list of all Werks