Only report new log lines with check_logfile bookmarks

[mickem]

Fixes #561.

check_logfile reads the entire file on every run, so a single ERROR line keeps failing the check for as long as it stays in the file. The only way to get each line reported once was real-time monitoring, which has to be configured on the agent; the polled path had no equivalent of the bookmarks check_eventlog gained.

The change

A bookmark option which remembers, per file and per bookmark name, how far the previous check read:

check_logfile file=/var/log/app.log "filter=column1 like 'ERROR'" "warning=count > 0" bookmark=app-errors
2/4 (ERROR failed to connect to db, ERROR failed to connect to db)|'count'=2;0;0

check_logfile file=/var/log/app.log "filter=column1 like 'ERROR'" "warning=count > 0" bookmark=app-errors
OK: Nothing found|'count'=0;0;0

As in check_eventlog the value is optional: bookmark (or bookmark=auto) derives the name from the file plus the filter / warning / critical expressions, so two checks over one file do not consume each other's lines. Positions live in the module and are persisted to the core storage (logfile.bookmarks) on unload, so a restart does not re-report everything.

Design notes

• Rotation is detected by size and content fingerprint (FNV-1a over the first 256 bytes). A size comparison alone — what the real-time path does in file_reader::compute_seek — misses a file replaced under the same name which is already larger than the stored offset. The fingerprint length is stored next to the hash so both sides always hash the identical byte range; hashing min(size, 256) on both sides would look like a rotation on every check while a file shorter than the cap is still growing.
• An unterminated trailing line is held back and the offset parks in front of it, so a half-written line is reported once, in full, by the check which sees its terminator rather than twice.
• The first check of a file reads it in full, then goes incremental — entries already in the file when monitoring starts are reported rather than silently dropped, matching how check_eventlog behaves on a fresh bookmark.
• Checks without bookmark neither read nor advance any position and behave exactly as before, so an ad-hoc full scan can be run at any time.

Tests

• check_logfile_test — 25 new unit tests over the pure state logic (hash stability, serialize/parse incl. rejecting a negative offset that would wrap into a huge one, and every resume/restart/skip decision). 35/35 pass.
• tests/checklogfile-commands.test.ts — 10 integration tests over REST (which also pins that a bare bookmark token is accepted), covering incremental reporting, the held-back partial line, truncation, replacement by a larger file, separate/auto names, and mixing bookmarked with unbookmarked checks. One case drives two nscp client --boot processes against a shared data-path to prove the position survives a restart. 10/10 pass.

Docs: docs/samples/CheckLogFile_check_logfile_{desc,samples}.md, with output captured from real runs.

Caveat

An auto name embeds the filter text, so editing a filter starts a new position and leaves the old entry behind in nsclient.db. That is noted in the docs; check_eventlog has the same property.

🤖 Generated with Claude Code