how can I receive alerts for every new trigger matched for 'LOG'
list Jerry Yu
hi, there, I have a LOG check for "error: #1" "error: #2" in a log file. We'd like to receive email alerts for each every trigger matched, "%error: #" since we needs to know the all the error # reported. Right now, it generates email alerts. but not for every new triggers. No alerts are generated for a newly matched trigger log entry if the STATUS is red/yellow already. In my thinking, if the LOG check itself can be RECOVERED after 5m (I believe the default is 30m), this ought work. - Does anybody know how to change the default from 30m to 5m (for a single check/test)? - Any alternative/recommendations to get the desired results? I initially thought a 'creative' combination of 'REPEAT=5 DURATION<10' would do it...
list Peter Welter
Sounds a bit like a question I posted two weeks ago: Hobbit responds on status-changes (green-.yellow->red->etc). You can make it detect several issues, but when another issue comes up and the status itself does not change, you will not be notified. Although the GROUP-keyword for DISK and PROC adds granularity, this is not possible for LOG (yet?!) and although the GROUP-keyword is very powerful, the above remains so this does not solve your problem. Regards, Peter 2006/11/27, Jerry Yu <user-764c1f364fe0@xymon.invalid>:
▸
hi, there, I have a LOG check for "error: #1" "error: #2" in a log file. We'd like to receive email alerts for each every trigger matched, "%error: #" since we needs to know the all the error # reported. Right now, it generates email alerts. but not for every new triggers. No alerts are generated for a newly matched trigger log entry if the STATUS is red/yellow already. In my thinking, if the LOG check itself can be RECOVERED after 5m (I believe the default is 30m), this ought work. Does anybody know how to change the default from 30m to 5m (for a single check/test)? Any alternative/recommendations to get the desired results? I initially thought a 'creative' combination of 'REPEAT=5 DURATION<10' would do it...
list Jerry Yu
the LOG check clears itself after 30m, if it didn't see the offending entries again. If this 30m can be changed to 5m or 6m, then, I can get new offenders (as it will trigger status change for certain).
▸
On 11/28/06, Peter Welter <user-f55666bd0d1e@xymon.invalid> wrote:Sounds a bit like a question I posted two weeks ago: Hobbit responds on status-changes (green-.yellow->red->etc). You can make it detect several issues, but when another issue comes up and the status itself does not change, you will not be notified. Although the GROUP-keyword for DISK and PROC adds granularity, this is not possible for LOG (yet?!) and although the GROUP-keyword is very powerful, the above remains so this does not solve your problem. Regards, Peter 2006/11/27, Jerry Yu <user-764c1f364fe0@xymon.invalid>:hi, there, I have a LOG check for "error: #1" "error: #2" in a log file. We'd like to receive email alerts for each every trigger matched, "%error: #" since we needs to know the all the error # reported. Right now, it generates email alerts. but not for every new triggers. No alerts are generated for a newly matched trigger log entry if the STATUS is red/yellow already. In my thinking, if the LOG check itself can be RECOVERED after 5m (I believe the default is 30m), this ought work. Does anybody know how to change the default from 30m to 5m (for a single check/test)? Any alternative/recommendations to get the desired results? I initially thought a 'creative' combination of 'REPEAT=5 DURATION<10' would do it...
list Jerry Yu
anybody? I'd like to get confirmation, one way or the other, Hobbit at its current form won't work for this purpose, before I go down the road of custom scripts and such..
▸
On 11/28/06, Jerry Yu <user-764c1f364fe0@xymon.invalid> wrote:the LOG check clears itself after 30m, if it didn't see the offending entries again. If this 30m can be changed to 5m or 6m, then, I can get new offenders (as it will trigger status change for certain). On 11/28/06, Peter Welter <user-f55666bd0d1e@xymon.invalid> wrote:Sounds a bit like a question I posted two weeks ago: Hobbit responds on status-changes (green-.yellow->red->etc). You can make it detect several issues, but when another issue comes up and the status itself does not change, you will not be notified. Although the GROUP-keyword for DISK and PROC adds granularity, this is not possible for LOG (yet?!) and although the GROUP-keyword is very powerful, the above remains so this does not solve your problem. Regards, Peter 2006/11/27, Jerry Yu <user-764c1f364fe0@xymon.invalid>:hi, there, I have a LOG check for "error: #1" "error: #2" in a log file. We'd like to receive email alerts for each every trigger matched, "%error: #" since we needs to know the all the error # reported. Right now, it generates email alerts. but not for every new triggers. No alerts are generated for a newly matched trigger log entry if theSTATUS isred/yellow already. In my thinking, if the LOG check itself can be RECOVERED after 5m (I believe the default is 30m), this ought work. Does anybody know how to change the default from 30m to 5m (for a single check/test)? Any alternative/recommendations to get the desired results? I initially thought a 'creative' combination of 'REPEAT=5 DURATION<10' would do it...
list Jerry Yu
it seems the 30m is hard-coded as MAXMINUTES in the client/logfetch.c. So, for my purpose, I modified it to 5m. A more customizable approach, I guess, is to export MAXMINUTES and LINES_AFTER_TRIGGER, etc as run-time configurables. Here is the simplest patch. 35c35 < #define MAXMINUTES 30 ---
#define MAXMINUTES 5
▸
On 12/1/06, Jerry Yu <user-764c1f364fe0@xymon.invalid> wrote:
anybody? I'd like to get confirmation, one way or the other, Hobbit at its current form won't work for this purpose, before I go down the road of custom scripts and such.. On 11/28/06, Jerry Yu <user-764c1f364fe0@xymon.invalid> wrote:the LOG check clears itself after 30m, if it didn't see the offending entries again. If this 30m can be changed to 5m or 6m, then, I can get new offenders (as it will trigger status change for certain). On 11/28/06, Peter Welter <user-f55666bd0d1e@xymon.invalid> wrote:Sounds a bit like a question I posted two weeks ago: Hobbit responds on status-changes (green-.yellow->red->etc). You can make it detect several issues, but when another issue comes up and the status itself does not change, you will not be notified. Although the GROUP-keyword for DISK and PROC adds granularity, this is not possible for LOG (yet?!) and although the GROUP-keyword is very powerful, the above remains so this does not solve your problem. Regards, Peter 2006/11/27, Jerry Yu <user-764c1f364fe0@xymon.invalid>:hi, there, I have a LOG check for "error: #1" "error: #2" in a log file. We'd like to receive email alerts for each every trigger matched, "%error: #" since we needs to know the all the error # reported. Right now, it generates email alerts. but not for every new triggers. No alerts are generated for a newly matched trigger log entry if theSTATUS isred/yellow already. In my thinking, if the LOG check itself can be RECOVERED after 5m (I believe the default is 30m), this ought work. Does anybody know how to change the default from 30m to 5m (for a single check/test)? Any alternative/recommendations to get the desired results? I initially thought a 'creative' combination of 'REPEAT=5 DURATION<10' would do it...