Brian A. Seklecki wrote: > On Wed, 2008-01-02 at 16:14 +0000, Hari Sekhon wrote: > >> I want to log every nrpe call that is made including the command it ran, >> source, username the command is running as etc so I have a more full >> audit trail. >> >> I have googled and read http://nagios.sourceforge.net/docs/nrpe/NRPE.pdf >> but this seems very basic, for beginners really. >> There is only a brief mention of nrpe.cfg and how to added a remote check. >> What I >> > > Set values: > > debug=1 in nrpe.conf > > > As for logging, it logs to static facility hard-coded into the code > (which you cannot change during runtime -- this is a NFS/Bug issue). > Google: nagios+seklecki+nrpe+nsca+syslog > > You can work around it by routing message to a custom destination in > syslog-ng(8) using a program{} filter. > Yes syslog-ng is excellent I know. I have tried the workaround of using debug but this produces a massive amount of logging, it lists every single command defined in nrpe every single time an nrpe call is made. This means I could be getting 100 lines of logging for every command I call every time. This is completely over the top and might just harm my logging infrastructure.
While syslog-ng could be used to filter all this out, I am hesitant to do this as it really feels like a hack... I think I might live without this until someone comes up with a way to do it properly within nrpe, or until I get some time to try to do this and submit a patch (which will definitely not be any time soon). Unless anyone else has any better ideas? -h -- Hari Sekhon ------------------------------------------------------------------------- This SF.net email is sponsored by: Microsoft Defy all challenges. Microsoft(R) Visual Studio 2005. http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/ _______________________________________________ Nagios-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/nagios-users ::: Please include Nagios version, plugin version (-v) and OS when reporting any issue. ::: Messages without supporting info will risk being sent to /dev/null
