bebehei / nagios-plugin-check_borg

nagios plugin to monitor borg repositories

check_borg

Check borg repository for date of latest archive.

Usable with nagios, icinga2 or any other nagios-fork.

Usage

./check_borg [ -C CONF ] [ -R <borg-repo-url> ] [ -P <borg-archivename-prefix> ] [ -c <date> ] [ -w <date> ]

<date> can be any valid format parsable by the date-command. So last day or 12 hours ago would be valid dates.

-R can be omitted, when BORG_REPO is set in the environment.

CONF is a file, which will get sourced. It can export variables like BORG_PASSPHRASE and BORG_REPO. You can separate with this file your borg specific secrets from the icinga2 configuration.

Non-standard executable paths

• If your borg executable is not installed in your $PATH or is not called borg, you can define the environment variable BORG to point to the correct command.
• If the GNU date executable is not installed as date, you can set the environment variable DATE to point to the correct date command.

Passwords

Export BORG_PASSPHRASE.

Requirements

• GNU's version of date.
• borgbackup

Warnings

• Be sure about the implications, when monitoring a repository secured with a passphrase.
• I don't know how to exclude checkpoints in borg list in combination with --format='{time}{NUL}'.

nagios-plugin-check_borg's Issues

borg env vars

Hi there!

Thanks for your contribution. Great script. Exactly what I was looking for, but I think borg's env variables like BORG_PASSPHRASE and BORG_REPO should be included in check_borg and not in any insecure nagios/icinga file, because this files are usually readable by the unprivileged nagios/icinga user and therefore a potential security issue.

My fix for this issue is to change permissions to 0700 on check_borg and execute check_borg via sudo by allowing the nagios user (in my case) to remotely execute this plugin via nrpe.

BORG_PASSPHRASE and BORG_REPO are exported in check_borg directly. Would be nice, if check_borg wouldn't insist on the -R switch, if BORG_REPO is set.

Licence for check_borg?

Hi,

First of all, thanks for your work and for sharing this plugin.

I've made a couple of changes to make this script work under FreeBSD, but noticed that there's no licence along your code clarifying what I may do with your code and what not. :)

So I'd like to ask you kindly to add a licence to this repository.

FormattingError on date

# ./check_borg -R /data/backups/borg/
Formatting Error: "{time}{NUL}".format({'utcnow': datetime.datetime(2018, 1, 2, 15, 45, 44, 95787), 'user': 'root', 'borgpatch': '1.0.9', 'now': datetime.datetime(2018, 1, 2, 16, 45, 44, 95767), 'hostname': 'prod-web2', 'fqdn': 'prod-web2', 'pid': 4005, 'borgversion': '1.0.9', 'borgmajor': '1', 'borgminor': '1.0'}): KeyError('time')
date: invalid date '@'

It seems that now borg uses --list-format LISTFORMAT not --format

Exclude checkpoint archives

Using --last 1 will eventually show a checkpoint archive, which I not consider a successful archive (which you documented already in the README).

I use this to show the last successful backup timestamp in the repo:

borg list --sort timestamp  --format '{time}{TAB}{name}{NEWLINE}'  $REPOSITORY  | grep -v '\.checkpoint$' | tail -1 |  cut -f 1

Running check_borg while running borg create fails

Hi there,

running check_borg while a borg backup via borg create is running results into
Failed to create/acquire the lock $BORG_REPO/lock.exclusive (timeout).
which in turns lets NRPE fail with NRPE: Unable to read output.

Any ideas how to solve this issue?

BR z3dm4n

Edit:

It's the borg list that fails to acquire the lock. As it seems to me, this is a limitation within borg's locking implementation. So I guess, that we won't get around this easily within the limits of borg. I'll think about a workaround and will get back to you (via PR).

date command

Hi there... again! ;-)

It seems that GNU date gives a f*** about POSIX compatibility. I would like to run check_borg on my FreeBSD boxes as well, but *BSD date doesn't like the --date switch of GNU date.

The date command confuses me at the moment. I need to look deeper inside your code to fix the issue. Maybe you can give me a little hint on how to fix this for *BSD.

Differences between both commands

Thanks a lot!