OP5 Monitor - How to understand possible causes for an empty event log page

The Report > Event log page in OP5 Monitor shows log messages through filtering by check boxes that can be modified by the user. This page describes some possible reasons for why you may see an entirely empty event log page, or perhaps why you are not seeing what you expect.

Understanding where the data comes from

The data on this page is not stored in any database, nor is it stored in memory. The logs displayed depend on a workflow that reads log files from disk. Here are some steps you can go through to understand where this workflow breaks:

Verify that the data is available via Livestatus/LMD

You should be able to run the following command and get the first 10 log lines:

# mon query ls log | head

If you get no output, an empty page in the Web GUI is to be expected.

Verify that the "archives" folder exists

You may have deleted this folder to conserve space, as it contains old Naemon logs. This is fine — although there may be legitimate uses for these files, so we recommend compressing the folder instead of deleting it — but when doing so, you must ensure that the folder still exists, even if it is empty.

If this directory does not exist, you need to create it:

# ls /opt/monitor/var/archives
ls: cannot access /opt/monitor/var/archives: No such file or directory

# mkdir /opt/monitor/var/archives

This may be enough to show you current logs from the regular naemon.log file.

Verify that naemon is running, and that naemon.log has data

The following command should show your local node (ipc) as "active":

# mon node status

If not, run "mon restart". If this does not help, troubleshoot why Naemon is not starting. It may be helpful to run Naemon manually from the CLI to get additional clues as to why it refuses to start:

# /usr/bin/naemon /opt/monitor/etc/naemon.cfg

If Naemon is running, have a look at your current log file and make sure the latest entries are current:

# tail /opt/monitor/var/naemon.log | perl -pe 's/(\d+)/localtime($1)/e'

For further assistance please contact support.