alert based on match count on log file

2 messages in this thread

list Asif Iqbal · Thu, 21 May 2015 15:37:58 -0400 ·

Is it possible to get an alert only when 'cannot connect to remote server'
shows up more than 5 times in last 5 mins?

So kind of an improvement over LOG on analysis.cfg with a COUNT field like
below

LOG /var/log/daemon.log %cannot.connect.to.remote.server COUNT>5

Thanks

-- 
Asif Iqbal
PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu
A: Because it messes up the order in which people normally read text.
Q: Why is top-posting such a bad thing?

list Mark Felder · Fri, 22 May 2015 08:48:07 -0500 ·

▸ quoted from Asif Iqbal


On Thu, May 21, 2015, at 14:37, Asif Iqbal wrote:

Is it possible to get an alert only when 'cannot connect to remote
server'
shows up more than 5 times in last 5 mins?

So kind of an improvement over LOG on analysis.cfg with a COUNT field
like
below

LOG /var/log/daemon.log %cannot.connect.to.remote.server COUNT>5

I think you can do this with swatch, but it would be nice to not have to
deploy swatch and have Xymon do this work :-)

alert based on match count on log file 🔗 link

alert based on match count on log file