diff --git a/testcases/files/logs/nagios b/testcases/files/logs/nagios
new file mode 100644
index 00000000..9577b327
--- /dev/null
+++ b/testcases/files/logs/nagios
@@ -0,0 +1,4 @@
+# Access of unauthorized host in /etc/messages
+# failJSON: { "time": "2005-02-39T11:22:44", "match": true , "host": "50.97.225.132" }
+Feb  3 11:22:44 valhalla nrpe[63284]: Host 50.97.225.132 is not allowed to talk to us!
+