alert based on match count on log file

On Thu, May 21, 2015, at 14:37, Asif Iqbal wrote:

Is it possible to get an alert only when 'cannot connect to remote
server'
shows up more than 5 times in last 5 mins?

So kind of an improvement over LOG on analysis.cfg with a COUNT field
like
below

LOG /var/log/daemon.log %cannot.connect.to.remote.server COUNT>5

I think you can do this with swatch, but it would be nice to not have to
deploy swatch and have Xymon do this work :-)