Action on file content tests

[Florian Munz]

Hello,

I am watching my httpd_error log file for a particular string with the
'if match regex' statement. The problem is that this string doesn't
appear only once if it appears. So I get usually 10 alerts in the first
cycle and more than 100 alerts in the cycles after that.

What I want to do is restart the apache server if that strings appears
but after some tests with the EXEC action and RESTART action (letting
the apache monitor depend on the file content test) it seems for every
alert it trys to restart the server which is definitely not good.

What can I do that the file content test behaves more like a connection
test? So that it alerts once on failure (the specific regex is matched)
and then again if the string stops appearing in the logfile?


thanks,
Florian