This is probably the last version.

nlog

@@ -23,7 +23,7 @@ aType="(ALERT|NOTIFICATION|EVENT HANDLER)"
 verbose=""
 
 do_debug() {
-  [ -n "$verbose" ] && echo "$*"
+  [ -n "$verbose" ] && echo "### DEBUG: $*"
 }
 
 print_help() {
@@ -35,6 +35,7 @@ Usage:
 	--current show CURRENT HOST|SERVICE STATE information
 	--state <warning type (OK, WARNING, CRITICAL, UNKNOWN)> no default
 	--ok|--warn|--warning|--crit|--critical only print things that match
+	--up|--down|--un only print things that match (un=unreachable)
 	--hard|--sort only print things that match
 	--soft only print soft stuff
 	--sev|--severity <type (HARD, SOFT)>, default=all
@@ -71,6 +72,9 @@ while [ -n "$1" ]; do
     -s|--service) service="$2"; shift 2;;
     --state) state="$2"; shift 2;;
     --ok) state="OK"; shift 1;;
+    --up) state="UP"; shift ;;
+    --down) state="DOWN"; shift 1;;
+    --un) state="UNREACHABLE"; shift 1;;
     --current) aSource="(HOST|SERVICE)"; aType="STATE"; shift 1;;
     --warn|--warning) state="WARNING"; shift 1;;
     --crit|--critical) state="CRITICAL"; shift 1;;
@@ -93,9 +97,9 @@ done
 
 # $1                              $2      $3    $4       $5  $6
 # [fromTime]  aSource aType: host;service;state;severity;num;text
-# $1                                                                   $2        $3    $4 $5
+# $1                                         $2                          $3        $4    $5 $NF
-# [1690749418] HOST ALERT:    Security Cameras;                        DOWN;     SOFT; 1; CRITICAL - 192.168.1.88: rta nan, lost 100%
+# [1723708041] SERVICE ALERT: localhost;     URL Status: frommyhive.com; CRITICAL; SOFT; 1; CRITICAL - Socket timeout
-# [1690765779] SERVICE ALERT: DD-WRT;           Port: vlan1 Bandwidth; CRITICAL; SOFT; 4; CRITICAL - Current BW in: 8.22Mbps Out: 1.58Mbps
+# [1723722735] HOST ALERT: Security Cameras;                                 DOWN; SOFT; 1; CRITICAL - 192.168.1.88: rta nan, lost 100%
 #                                                                            (NF-3)(NF-2)(NF-1)
 # [1723694400] CURRENT HOST STATE: localhost; UP;HARD;1;OK - 127.0.0.1 rta 0.067ms lost 0%
 # (HOST|SERVICE) (DOWNTIME|FLAPPING)? (ALERT|NOTIFICATION)
@@ -112,9 +116,17 @@ fi
 timeSub=""
 [ -z "$noTime" ] && timeSub="&& sub (/^\[[0-9]{10}]/, strftime (\"%Y-%m-%d %H:%M:%S\", substr (\$1, 2, 10)), \$1)"
 
-do_debug "DEBUG: host=$host"
+do_debug "host=$host"
-do_debug "DEBUG: service=$service"
+do_debug "service=$service"
-do_debug "DEBUG: awk=^\[[0-9]{10}] (GLOBAL |CURRENT )?$aSource (DOWNTIME |FLAPPING )?$aType: .*$host.*$service"
+do_debug "awk=^\[[0-9]{10}] (GLOBAL |CURRENT )?$aSource (DOWNTIME |FLAPPING )?$aType: .*$host.*$service"
+do_debug "state=$state"
+do_debug "severity=$severity"
+do_debug "num=$num"
+
+# $(NF)   = the text of the output
+# $(NF-1) = check number (of max_retries)
+# $(NF-2) = HARD/SOFT
+# $(NF-3) = UP/DOWN/UNREACHABLE/OK/WARNING/CRITICAL/etc
 
 tail -n +1 $tailMode $files | gawk -F\; "\
 	BEGIN {IGNORECASE=1} \
@@ -125,15 +137,13 @@ tail -n +1 $tailMode $files | gawk -F\; "\
 	$timeSel \
 	$timeSub \
 	{
-	  sub(/OK/, \"\x1b[32mOK\x1b[0m\", \$3)
+	  sub(/OK/, \"\x1b[32mOK\x1b[0m\", \$(NF-3))
-	  sub(/WARNING/, \"\x1b[31mWARNING\x1b[0m\", \$3)
+	  sub(/WARNING/, \"\x1b[31mWARNING\x1b[0m\", \$(NF-3))
-	  sub(/CRITICAL/, \"\x1b[33mCRITICAL\x1b[0m\", \$3)
+	  sub(/CRITICAL/, \"\x1b[33mCRITICAL\x1b[0m\", \$(NF-3))
-	  sub(/UP/, \"\x1b[32mUP\x1b[0m\", \$2)
+	  sub(/UP/, \"\x1b[32mUP\x1b[0m\", \$(NF-3))
-	  sub(/UNREACHABLE/, \"\x1b[31mUNREACHABLE\x1b[0m\", \$2)
+	  sub(/DOWN/, \"\x1b[33mDOWN\x1b[0m\", \$(NF-3))
-	  sub(/DOWN/, \"\x1b[33mDOWN\x1b[0m\", \$2)
+	  sub(/UNREACHABLE/, \"\x1b[31mUNREACHABLE\x1b[0m\", \$(NF-3))
-	  sub(/HARD/, \"\x1b[35mHARD\x1b[0m\", \$3)
+	  sub(/HARD/, \"\x1b[35mHARD\x1b[0m\", \$(NF-2))
-	  sub(/SOFT/, \"\x1b[36mSOFT\x1b[0m\", \$3)
+	  sub(/SOFT/, \"\x1b[36mSOFT\x1b[0m\", \$(NF-2))
-	  sub(/HARD/, \"\x1b[35mHARD\x1b[0m\", \$4)
-	  sub(/SOFT/, \"\x1b[36mSOFT\x1b[0m\", \$4)
 	  printf \"%s: %s;%s;%s;%s;%s\n\", \$1, \$2, \$3, \$4, \$5, \$6
 }"