System Log Check Reference

All parameters, thresholds, and configuration options for the system log check in octoja.

Written By Erdinc Akay

Last updated About 2 months ago

The system log check scans the system log (systemd-journald on Linux, Unified Logging on macOS) for entries at or above a specified priority level and alerts when the count exceeds a threshold.

Configuration fields

FieldTypeRequiredDefaultDescription
Lookback period (minutes)minutes (1–1440)No60How far back to scan. Values outside the range are clamped at runtime.
Max entriesinteger (1–500)No20Maximum entries to retrieve. Values outside the range are clamped at runtime.
Minimum priorityselect (0 / 2 / 3 / 4)No3 - ErrorMinimum syslog priority level to include (see the table below)
Warning thresholdintegerNo5Number of matching entries that triggers a warning
Critical thresholdintegerNo20Number of matching entries that triggers a critical result
Exclude patternslist of stringsNo—Patterns to exclude from matching

Minimum priority — configurable values

The editor exposes a subset of syslog priority levels:

PriorityValueDescription
Emergency0System is unusable
Critical2Critical conditions
Error3Error conditions
Warning4Warning conditions

Platform support

PlatformSupportedLog source
WindowsNo (use Event Log check)—
LinuxYessystemd-journald (journalctl)
macOSYesUnified Logging (log show --predicate messageType ==)

Notes

  • On Linux, the check requires journalctl (systemd-journald). If journalctl is not available, the check returns a Failure result — there is no fallback to /var/log/syslog.
  • Set the lookback period to match or exceed the check interval.
  • If the Warning threshold is set higher than the Critical threshold, the two values are silently swapped at runtime so that Warning ≤ Critical.
  • The check interval is set in the check definition (not in the editor); the default is 15 minutes.
  • Exclude patterns are matched (case-insensitive substring) against the entry message only — not the source.

See also: Configure a System Log Check