Usually something like:
//usr/lib/nagios/plugins/check_log-F logfile -O oldlog -q query
on the machine you want to monitor :
edit the /etc/nagios/nrpe.cfg file to include the command you want to execute (there should be a number of examples)
in my example:
command[check_login]=/usr/lib/nagios/plugins/check_log -F /var/log/messages -O /home/nagiosuser/logs/check_log.badlogins.old -q "LOGIN FAILURE"
restart the nrpe daemon:
/etc/init.d/nagios-nrpe-server restart
on the nagios server:
edit your commands.cg file to include the nrpe command
for example
define command{
command_name check_login
command_line /usr/lib/nagios/plugins/check_nrpe -H $HOSTADDRESS$ -c check_login
}
edit the config file for the remote host you're monitoring to add this command
in my example:
define service{
use generic-service
host_name remotehost
service_description Failed login check
check_command check_login
}