As IT moves towards the cloud there are certain things we can't monitor effectively with Nagios, so I made a plugin to check RSS feeds. Many cloud services offer an RSS feed with their status. check_rss allows you to parse these feeds either looking for certain keywords that exist (or don't) or the date of the last post.
check_rss requires the feedparser and argparse python libraries. For Ubuntu you can install with
sudo apt-get install python-feedparser python-argparse
usage: check_rss [-h] -H RSSFEED [-c CRITICALIF] [-C CRITICALNOT] [-w WARNINGIF] [-W WARNINGNOT] [-t] [-p] [-v VERBOSITY]
optional arguments:
-h, --help - show this help message and exit
-H RSSFEED - URL of RSS feed to monitor
-c CRITICALIF, --criticalif CRITICALIF - Comma separated, quoted list of strings that will result in critical condition if PRESENT
-C CRITICALNOT, --criticalnot CRITICALNOT - Comma separated, quoted list of strings that will result in critical condition if MISSING
-w WARNINGIF, --warningif WARNINGIF - Comma separated, quoted list of strings that will result in warning condition if PRESENT
-W WARNINGNOT, --warningnot WARNINGNOT - Comma separated, quoted list of strings that will result in warning condition if MISSING
-T HOURS, --hours HOURS - Hours since last post. Will return critical if less than designated amount.
-T HOURS, --hours HOURS - Hours since last post. Will return critical if less than designated amount.
-t, --titleonly - Search the titles only. The default is to search for strings matching in either the title or description
-p, --perfdata - If used will keep very basic performance data (0 if OK, 1 if WARNING, 2 if CRITICAL, 3 if UNKNOWN)
-v VERBOSITY, --verbosity VERBOSITY - Verbosity level. 0 = Only the title is returned. 1 = Title and link are returned. 2 = Title, link and description are returned (Default)
If you do not specify any warning or critical conditions, it will
always return OK. This will only check the newest feed entry.
Changelog:
2015-06-15 - v0.35 - Fixed issue where having multiple missing strings would require them all to be missing to raise an error.
2011-11-02 - v 0.3 - Added check by time, fixed verbosity bug and changed data separators to semi-colons to not mess up performance data.
Changelog:
2015-06-15 - v0.35 - Fixed issue where having multiple missing strings would require them all to be missing to raise an error.
2011-11-02 - v 0.3 - Added check by time, fixed verbosity bug and changed data separators to semi-colons to not mess up performance data.
John,
ReplyDeleteI like the RSS check idea. Have you ever seen a nagios plugin called: "check_cap". I have a working Nagios instance and actively monitoring hosts without any problem. But I can't get the above plugin to work. I was wondering if you could take a look at this and see if you can make it work. Here is the URL containing code:
http://files.tonyyarusso.com/check_cap
More info:
http://exchange.nagios.org/directory/Plugins/Others/check_cap-3A-check-Common-Alerting-Protocol-feeds/details
I would greatly appreciate your input.
Thanks
Mark
@Mark, thanks for your interest! I'm confused, do you need help with the check_cap plugin, or my check_rss plugin? If you're having trouble with the check_cap plugin, you'd have better luck contacting the author of that plugin, Tony Yarusso.
ReplyDeleteJohn
DeleteThanks for your response. I apologize for the confusion. I actually need help with the "check_cap" plugin. I did not get a response from Tony Yarusso and came across your nice plugin with similar concept. So I thought I should ask your help on getting the "check_cap" work with a Nagios Core instance. There is no instruction on how to setup the plugin anywhere I can find. I would greatly appreciate any help from you to get this plugin work on Nagios core (v3.3.1). Is there any contact email I can use to email you my environment?
Thanks again.
Mark
Awesome plugin! Thanks for taking the time to write and publish it!
ReplyDeleteVery cool plugin ! Very handy. I've tweaked it a bit to support empty feeds (which in our context is VERY good to have, ie the less I hear about my provider the better)
ReplyDeleteUsing : http://status.aws.amazon.com/rss/s3-us-west-2.rss
~/git/check_rss/ ±|master| (test) $ ./check_rss_john.py -T 1 -H http://status.aws.amazon.com/rss/s3-us-west-2.rss
CRITICAL: Could not parse URL (http://status.aws.amazon.com/rss/s3-us-west-2.rss)
Patched version
~/git/check_rss/ ±|master| (test) $ ./check_rss.py -T 1 -H http://status.aws.amazon.com/rss/s3-us-west-2.rss
OK - No news == good news
See the source at https://github.com/jrottenberg/check_rss/blob/master/check_rss.py
./checknew_rss --hours 145 -H http://status.aws.amazon.com/rss/s3-us-west-2.rss
DeleteOK - Posted 10301 hrs ago ; Title: Service is operating normally: [RESOLVED] Increased error rates in Amazon S3 ; Description: Error rates have returned back to within normal ranges. The service is operating normally. ; Link: http://status.aws.amazon.com
How is that saying 10301 hrs ago? Is that right one. I believe script is telling that the site was last updated 10301 hrs ago
If you look at the RSS feed, the most recent post in the RSS feed was a year ago. Most status RSS feeds only post when there is something wrong, then an "all clear" message. They don't continually post "all clear" messages. So don't worry, that's a good thing. It just means there hasn't been any issues in a year.
DeleteI seem to be getting errors running this on RHEL5.9. Any idea what might be the issue?
ReplyDelete# ./check_rss -H http://www.webhelpdesk.com/feed/
Traceback (most recent call last):
File "./check_rss", line 160, in ?
result = main(sys.argv)
File "./check_rss", line 81, in main
output = ': Posted {hourssinceposted} hrs ago ; Title: {title} ; Description: {description} ; Link: {link}'.format(hourssinceposted=hourssinceposted, title=title, description=description, link=link)
AttributeError: 'str' object has no attribute 'format'
I think you need Python V2.6 at a minimum, which may not be present on RHEL5.9
DeleteI had similar issue with older CentOS 5 monitoring system that I didn't want to upgrade just to get use this plugin. I got around the Python2.6 dependency as follows:
DeleteInstall python-feedparser, python-argparse and python26 using the EPEL repo. Python 2.6 will install to /usr/bin/python26
The problem here is that python26 will not find the modules, as they are installed for python 2.4
To get around this, remove the /usr/lib/python2.6/site-packages directory and create a symlink to /usr/lib/python2.4/site-packages
ln -s /usr/lib/python2.4/site-packages /usr/lib/python2.4/site-packages
You will get a few warning, which you can suppress, but the script will work. You just need to edit the first line to use /usr/bin/python26 instead of /usr/bin/python
Typo correction:
Deleteln -s /usr/lib/python2.4/site-packages /usr/lib/python2.4/site-packages
should be
ln -s /usr/lib/python2.4/site-packages /usr/lib/python2.6/site-packages
Was just what I was looking for, many thanks. Would be nice to be able to set an expiry though, otherwise the nagios alert will remain until a new RSS entry is published that does not match?
ReplyDeleteI patched this script to make it work for the inverse case, i.e. you want to check that the items in the feed are not older than a certain time.
ReplyDeletehttps://github.com/denisbr/nagios-plugins/blob/master/check_rss
Hello, it looks awesome but I didn't ahd to chance o try it, as the service in question,only delivers the rss via https with a selfsigned certificate, platform owner refuse to change that, and as I am one heck of python noob, what can be done to to retrieve the rss via https like wget with --no-check-certificate. Thanks!
ReplyDeleteHmmm. It doesn't look like feedparser (the library I'm using to parse the feeds) supports that. But all hope is not lost. The only way I can think of doing this would be to remove lines 55 & 56:
Deleteif ( rssfeed.find('http://') != 0 ):
rssfeed = 'http://{rssfeed}'.format(rssfeed=rssfeed)
Then, create a cronjob that will download the feed every X amount of minutes (whatever your check interval in Nagios is) via wget. Then point the plugin at the downloaded file location instead of the URL of the feed. Untested, (and a little hacky) but that *should* work.
On line 131: "for search in criticalnot", this seems to have changed from v0.30, where it as "for search in warningnot" - that seems to be a bug? Also, do you have this somewhere where we can submit a CR, e.g. github, etc? I see e.g. https://github.com/jrottenberg/check_rss but I'd like something canonical.
ReplyDeleteawesome plugin. thanks!
ReplyDelete