I understand you perfectly.
The problem with monitoring logfiles is that if check_logfile gets two matches on a pattern it will only notify me with the last matched line and a counter that says there are 2 matches in the logfile. That means that I have to log in to the server each time to check manually the logfile. We have 300 unixboxes and that will cause a lot of extra work.
If I active the commandline option to check_logfile "--report long" I will get more info in webinterface but still only a one-liner in my notify-mail. But the alarms will automaticaly be cleared after some time and that is not good enough either.
You can also in the check_logfile use the script option (as you mentioned) and in the script use $CHECK_LOGFILE_PROTOCOLFILE to get the diff-file with the matches in it and mail the matched lines from there, but then you cannot use the contacts in Nagios which means that you have to create you own contactgroups besides Nagios.
It seems that the notify-module not recieves more than one line from the alarm (SERVICEOUTPUT) which is the last line if there are multiple lines in a match.
Is there someone who knows a proper way to get around this?
I do need it.