check_journallog

#!/bin/bash
# ======================================================================
#
# Check count of written entries in journallog
#
# requirements:
# - journalctl
# - sudo permissions to journalctl to fetch all lines of all units
#
# ----------------------------------------------------------------------
# 2023-10-12  v0.1  <axel.hahn@unibe.ch>     initial version
# 2023-10-13  v1.0  <axel.hahn@unibe.ch>     update sudo command; set v1.0
# ======================================================================

. $( dirname $0 )/inc_pluginfunctions

export self_APPVERSION=1.0

tmpfile=/tmp/last_journallog_line_${USER}.txt

# ----------------------------------------------------------------------
# FUNCTIONS
# ----------------------------------------------------------------------

# show help text
function showHelp(){
    local _self; _self=$(basename $0)
cat <<EOF
$( ph.showImlHelpHeader )

Show number of lines in journallog per min.
A strong change of the written lines per min COULD indicate a problem.
It requires sudo permission on /bin/journalctl

The status is ...
- unknown - if journalctl is not available
          - if the script is started the 1st time and stores the last 
            line of the journallog
- ok - when showing written tnries per min
- warning/ critical - when giving -c and -w parameter values

This plugin sends performancedata.

SYNTAX:
  $_self [-h] [-w WARN_LIMIT] [-c CRITICAL_LIMIT]

OPTIONS:
  -h                this help
  -w VALUE          warning level  (default: 0)
  -c VALUE          critical level (default: 0)

PARAMETERS:
  None.

EXAMPLES:

  $_self  show count of newly written log entries
  $_self -w 100 -c 200
                    Set warning level to 100 written lines per min and
                    critical to 200.
  $_self -w 100
                    Set warning level to 100 written lines per min but
                    no critical limit. This check then never will send a
                    critical status.
EOF
}

# ----------------------------------------------------------------------
# MAIN
# ----------------------------------------------------------------------

# handle params
ph.hasParamoption "h" "$@"; bOptHelp=$?

if [ $bOptHelp -eq 0 ]; then
    showHelp
    exit 0
fi

ph.require journalctl

typeset -i iWarnLimit=$(     ph.getValueWithParam 0 w "$@")
typeset -i iCriticalLimit=$( ph.getValueWithParam 0 c "$@")


lastLine=$( cat "$tmpfile" 2>/dev/null )
if [ -z "$lastLine" ]; then
    ph.setStatus unknown
    if ! sudo -n journalctl --version >/dev/null 2>&1; then
      ph.status "User $USER has sudo permissions to execute journalctl."
      ph.exit
    else
      #
      # 1st run: initialize
      #
      ph.status "Initializing ... storing last line of jorunallog ..."
      sudo -n journalctl -n 1 | tail -1 > "$tmpfile"
    fi
else

    # Remark: parsing of date from journallog entry can fail because of
    #         language specific monthes or no date on multi line entries
    #         Thats why we take the timestamp of the tmpfile
    typeset -i iAge; iAge=$( ph.getFileAge "$tmpfile" )
    ts=$( date -d "${iAge} sec ago" +"%Y-%m-%d %H:%M:%S" )
    data=$( sudo -n journalctl --since "$ts" )

    # detect last seen position and count lines from there
    typeset -i iTotal; iTotal=$( wc -l <<< "$data" )
    typeset -i iFrom;  iFrom=$( grep -Fn "$lastLine" <<< "$data" | head -1 | cut -f 1 -d ':' )
    typeset -i iLines; iLines=$iTotal-$iFrom
    typeset -i iLinespermin; iLinespermin=$iLines*60/$iAge

    if [ $iWarnLimit -gt 0 -a $iWarnLimit -le $iLinespermin ]; then
      ph.setStatus "warning"
    fi
    if [ $iCriticalLimit -gt 0 -a $iCriticalLimit -le $iLinespermin ]; then 
      ph.setStatus "critical"
    fi 

    ph.perfadd "lines-per-min"    "${iLinespermin}"

    # output
    ph.status "Journallog stored $iLinespermin lines per min"
    sLimits=""
    test $iWarnLimit     -gt 0 && sLimits+="WARNING at $iWarnLimit"
    test $iWarnLimit     -gt 0 || sLimits+="No warning level"
    sLimits+="; "
    test $iCriticalLimit -gt 0 && sLimits+="CRITICAL at $iCriticalLimit"
    test $iCriticalLimit -gt 0 || sLimits+="No critical level "

    echo "Limits: $sLimits"
    echo "Raw data: Found $iLines new line(s) in the last $iAge sec"

    # for next run: insert last handled line
    test $iLines -gt 0 && tail -1 <<< "$data" > "$tmpfile"

fi

ph.exit

# ----------------------------------------------------------------------