Re: repeated file content match

[Martin Pala]

Hello Ben,

i didn't try such configuration but it looks fine and should work ... it 
depends however what you expect from it. It won't work as plain cross-cycle 
strings counter, but as indicator that the string showed up again in 3 
consecutive cycles.

The "foo_REPEATED.log" service condition requires match in 3 consecutive cycles 
to trigger the alert and it doesn't matter how many matches there were in 1 
(partial) cycle: if there are multiple matches in only one test cycle (for 
example 20x "ACTION_REQUIRED" string), given cycle matched - Monit will record 
the read position (end of the file) and the next cycle will start from where it 
stopped before. In order for the next cycle to match, new instance of 
"ACTION_REQUIRED" string had to be appended to the file again (at least one 
instance) - then this cycle will match too. And if this will occur 3rd time 
(again new occurrence of "ACTION_REQUIRED" string in cycle no. 3), then Monit 
will trigger the alert.

If you need to count the messages and trigger the alert anytime there are 3+ 
occurrences of the same string (even in the same cycle), it cannot be achieved 
with this configuration ... it would require new option for the content test 
(some counter test for the given pattern).

Regards,
Martin


> On 20 Oct 2014, at 15:11, Ben Soot <address@hidden> wrote:
> 
> Hello,
> 
> What is the best way to get alerts of repeated file content matches?
> 
> I have 2 rules one for the same file so i can then distinguish in mmonit the 
> service to send alerts to different mail addresses.
> 
> Somehow the alerts for the repeated rule are not triggered... Anybody done 
> sth like this?
> also i never got the service group
> 
> Im using monit 5.4 and mmonit 3.1.2
> 
> 
> thanks Ben
> 
> 
> set daemon  120
> ...
> 
> 
> check file foo.log  with path /home/foo.log
> 
>    if match
>          "^.*ACTION_REQUIRED.*$" then alert
> 
> check file foo_REPEATED.log  with path /home/foo.log
>    group repeatedfailure
>    if match
>          "^.*ACTION_REQUIRED.*$" within 3 cycles then alert
> 
> 
> 
> --
> To unsubscribe:
> https://lists.nongnu.org/mailman/listinfo/monit-general