On Mon, 25 Feb 2013 15:55:06 -0500, Michael Beatty
<user-4aea7c115850@xymon.invalid> wrote:
I see the comments made in logfetch.c
/* Is it ok for these to be hardcoded ? */
#define MAXCHECK 102400 /* When starting, dont look at more than 100
KB of data */
#define MAXMINUTES 30
#define POSCOUNT ((MAXMINUTES / 5) + 1)
#define LINES_AROUND_TRIGGER 5
My answer to this would be, "no".
Due to various reasons, it is not desirable to run my client more than once every hour. Therefore, the msgs check for log files is almost useless unless I change these values (and honestly, I'm not even sure that would work as I haven't seen if this would impact anything else). If I ran my client every hour, I would lose 50% of my log data.
I would like to see where the log check would be dependent on how long of an interval your client is run as opposed to a hard coded 30 minutes.
OK, just to clarify what these are for:
- MAXCHECK is only used when the client has not run before, to avoid searching gigabytes of log data. It does not affect how log files
are processed during normal client-cycles - that is controlled by the logsize setting in client-local.cfg.
- MAXMINUTES is only used to calculate POSCOUNT.
- POSCOUNT determines how many of the previous client cycles the client
will include in the client-data as "current logfile data".
What this means is that the "30" is really a red herring - what matters is
that the client will send data from the logfile generated during the last 7
times the client ran. So if the client runs only once an hour, then you'll
have logdata from the past 6 hours included in the client data.
Regards,
Henrik