Check_files for creation date newer than 2 days matching pattern


Having a tough time homing in on this and could use some help. I cannot seem to get an OK result. Also would like to transform creation values into something meaningful like hours. I am guessing that is seconds or ticks. Thanks.


  1. Filenames matching pattern lpt$vpn.*
  2. Path matching C:\PROGRA~2\Trend Micro\OfficeScan\PCCSRV\
  3. Critical = No files with creation date after 2 days ago (that match above criteria)

./check_nrpe -H ‘’ -c check_files -a “crit=creation lt -2d” ‘path=C:\PROGRA~2\Trend Micro\OfficeScan\PCCSRV’ pattern=“lpt$vpn.*”

CRITICAL: 10/14 files (lpt$vpn.819, lpt$vpn.821, lpt$vpn.823, lpt$vpn.289, lpt$vpn.813, lpt$vpn.817, lpt$vpn.819, lpt$vpn.821, lpt$vpn.823, lpt$vpn.817)|‘lpt$vpn.819_creation’=1550372629;0;1550611215 ‘lpt$vpn.821_creation’=1550455476;0;1550611215 ‘lpt$vpn.823_creation’=1550545492;0;1550611215 ‘lpt$vpn.825_creation’=1550631903;0;1550611215 ‘lpt$vpn.827_creation’=1550721834;0;1550611215 ‘lpt$vpn.289_creation’=1507738951;0;1550611215 ‘lpt$vpn.813_creation’=1550214237;0;1550611215 ‘lpt$vpn.817_creation’=1550300644;0;1550611215 ‘lpt$vpn.819_creation’=1550372616;0;1550611215 ‘lpt$vpn.821_creation’=1550455461;0;1550611215 ‘lpt$vpn.823_creation’=1550545475;0;1550611215 ‘lpt$vpn.825_creation’=1550631891;0;1550611215 ‘lpt$vpn.827_creation’=1550721821;0;1550611215 ‘lpt$vpn.817_creation’=1550301152;0;1550611215


I am closer and this does work, but why does it list the files twice?

./check_nrpe -H '' -c check_files -a "crit=count<1" "empty-state=critical" 'path=C:\PROGRA~2\Trend Micro\OfficeScan\PCCSRV' pattern="lpt\$vpn.*"  "filter= creation > -24h" 'empty-syntax=${status}: No files found' 'ok-syntax=${status}:${list}'

OK:lpt$vpn.829, lpt$vpn.829|'count'=2;0;1


So not too much activity here. Would be nice to build a more active community.


Created issue: