BBWin and Message problems

In case you didn't show us your whole <msgs> section, make sure your
match rule is before any other more general match rule (such as the
default red/error and yellow/warning rules). I believe the first match
wins.

Cheers.
D

-----Original Message-----
From: Stewart Larsen [mailto:user-4bb0ef2a7550@xymon.invalid]
Sent: Thursday, July 12, 2007 11:42 AM
To: user-ae9b8668bcde@xymon.invalid
Cc: user-ae9b8668bcde@xymon.invalid
Subject: Re: [hobbit] BBWin and Message problems

Thanks. I've read the manual, but the syntax below does not seem to
behave
the way I expect.

The first error I get  with that EventID triggers an alert.  I thought
with the syntax given, I would need to see 10 log entries within a 30
minute period before I get an alert.

Is this a bug in BBWin, or am I doing something incorrect here?

Stewart

Hello Stewart,


You can set a counter so you may only receive alert if several
events
on the same rule are matched. Default is 0 which means that the
first
event matched will generate an alert. count must be a positive
number.
count has no effect on ignore rules.


2007/7/11, Stewart Larsen <user-4bb0ef2a7550@xymon.invalid>:

Not sure if this is the right place...

I have a particular error in my logs.  It's not a real issus
unbless

I

see
10 of them in a 30 minute period, so I set up a rule in the msgs
section...

<msgs>
<setting name="summary" value="true" />
<match  logfile="Application" eventid="3317" count="10" delay="30m"

/>

</msgs>

Is this syntax correct?

The syntax is good but actually, count option just helps to trigger
events that appear often in the last 30 minutes (your delay
setting).
If count is reached, msgs agent will still report all of the events
because depending the rules, events can be different each other.

If you really doesn't want the event to be reported, may be you
should
ignore it definitively.

Regards,
--
Etienne GRIGNON

--
Stewart Larsen