Monitor OPNSense log file for link DOWN. For integration with Monit.

new-link-down-event.sh

#!/bin/sh

lastlog_file="/home/admin/link-down/lastlog.txt"
history_file="/home/admin/link-down/history.txt"
down_logs="clog /var/log/system.log | grep 'link state changed to DOWN$'"
last_log=`eval $down_logs | tail -1`

if [ ! -e $lastlog_file ]; then
  echo "$last_log" >$lastlog_file
  touch -A -235959 $lastlog_file
  echo "`date` Created $lastlog_file" >>$history_file
  exit 0
fi

read last_saved_log <$lastlog_file

if [ "$last_saved_log" = "$last_log" ]; then
  # echo "`date` No new DOWN events." >>$history_file
  exit 0
fi

if [ "$last_log" = "" ]; then
  echo "`date` Log file rolled/rotated or cleared." >>$history_file
  rm $lastlog_file
  touch $lastlog_file
  exit 0
fi

# Limit reports to no more than once per 480 minutes (6 hours)
last_event_time=`find /home/admin/link-down -name lastlog.txt -mmin +480`
if [ "$last_event_time" = "" ]; then
  echo "`date` Quelched: $last_log" >>$history_file

  # Update lastlog but preserve mtime from existing lastlog file
  echo "$last_log" >$lastlog_file.new
  touch -r $lastlog_file $lastlog_file.new
  mv $lastlog_file.new $lastlog_file
  exit 0
fi

echo "`date` DOWN event detected: $last_log" >>$history_file
echo "`date` $last_saved_log" >>$history_file
echo "$last_log" >$lastlog_file
echo Router link DOWN event

eval $down_logs | tail -5
exit 1