The Report > Event log page in OP5 Monitor shows log messages through filtering by check boxes that can be modified by the user. This page describes some possible reasons for why you may see an entirely empty event log page, or perhaps why you are not seeing what you expect.
Understanding where the data comes from
The data on this page is not stored in any database, nor is it stored in memory. The logs displayed depend on a workflow that reads log files from disk. Here are some steps you can go through to understand where this workflow breaks:
Verify that the data is available via Livestatus/LMD
You should be able to run the following command and get the first 10 log lines:
# mon query ls log | head
If you get no output, an empty page in the Web GUI is to be expected.
Verify that the "archives" folder exists
You may have deleted this folder to conserve space, as it contains old Naemon logs. This is fine — although there may be legitimate uses for these files, so we recommend compressing the folder instead of deleting it — but when doing so, you must ensure that the folder still exists, even if it is empty.
If this directory does not exist, you need to create it:
# ls /opt/monitor/var/archives
ls: cannot access /opt/monitor/var/archives: No such file or directory
# mkdir /opt/monitor/var/archives
This may be enough to show you current logs from the regular naemon.log file.
Verify that naemon is running, and that naemon.log has data
The following command should show your local node (ipc) as "active":
# mon node status
If not, run "mon restart". If this does not help, troubleshoot why Naemon is not starting. It may be helpful to run Naemon manually from the CLI to get additional clues as to why it refuses to start:
# /usr/bin/naemon /opt/monitor/etc/naemon.cfg
If Naemon is running, have a look at your current log file and make sure the latest entries are current:
# tail /opt/monitor/var/naemon.log | perl -pe 's/(\d+)/localtime($1)/e'
For further assistance please contact support.
Article is closed for comments.