"tail" plugin

The tail-plugin can be used to "tail" logfiles, i. e. follow them as tail -F does. Each line is given to one or more "matches" which test if the line is relevant for any statistics using a regular expression. So you could, for example, count the number of failed login attempts via SSH by using the following regular expression with the /var/log/auth.log logfile:

But counting lines that match is only the simplest application of this plugin. Take, for example, a daemon that writes the current number of users to a file periodically. You could collect this information with a regular expression like this:

As you can see the actual number of users is stored in the first "sub match". This value can then be used by collectd as a gauge value.

And there's even more: Per default, Exim logs the size of each email in its logfile. You can match this size and add all the values up. So you'll end up with a typical octet-counter which you can use with the ipt_bytes type, for example. Such a regular expression would look like this:

Hopefully we got you interested. If so, you might want to check out the "Plugin tail" section in the collectd.conf(5) manpage.

Example graphs

Dependencies

• None (except UNIX/libc of course ;)