System Log

The System Log check scans the system log for entries at or above a specified priority level and alerts when the count reaches or exceeds a threshold. This helps you detect errors and warnings in system logs that indicate problems. The check runs on Linux (systemd-journald, journalctl) and macOS (Unified Logging, log show) every 15 minutes by default. For Windows, use the Event Log Check instead.

Prerequisites

• You need the Monitoring Check Management permission. Your administrator assigns permissions under Administration → Groups.
• The target device must have a connected agent running Linux or macOS.
• On Linux, the check requires journalctl (systemd-journald).

Steps

1. Go to Devices and open the device.
2. Click the Checks tab → Add Check → System Log.
3. Configure Lookback period (minutes), Max entries, Minimum priority, and, under Thresholds, the Warning threshold and Critical threshold.
4. Optionally, add patterns under Exclude patterns (in the Filters section) to ignore known harmless messages.
5. Click Add Check.

After the first check interval, the result appears in the device's Checks tab.

Settings

• Set the lookback period to match or exceed the check interval so no entries are missed between runs. The check interval is set in the check definition (not in the editor); the default is 15 minutes.
• If the Warning threshold is set higher than the Critical threshold, the two values are silently swapped at runtime so that Warning ≤ Critical.
• Max entries caps retrieval, so Total errors never exceeds it. Keep the Critical threshold at or below Max entries — a Critical threshold above Max entries is never reached.
• Exclude patterns are matched (case-insensitive substring) against the entry message only — not the source. They are applied after retrieval, so excluded entries still use up slots of Max entries and can crowd out other entries.

Minimum priority

The editor exposes a subset of syslog priority levels:

macOS has no direct equivalent of the syslog priorities. Minimum priority 0 or 2 matches fault messages, 3 matches error messages, and 4 matches error and fault messages.

Results

The check reports a warning or critical result as soon as the number of matching entries (Total errors) reaches or exceeds the Warning threshold or Critical threshold. If journalctl is not available on Linux, the check returns a Failure result — there is no fallback to /var/log/syslog.

Tips

• The default priority of 3 (Error) is a good starting point. Lower it to 4 (Warning) if you also want to capture warnings.
• Use exclusion patterns to filter out frequent, known messages that require no action.