Re: repeated file content match

[Ben Soot]

Hi Martin,

Thanks for the answer and sry for my late reply:

I finally got it to work, it was an issue with the syntax (one needs to use "for 3 cycles" instead 
of "within 3 cycles" as an action condition clause). This is unclear from the documentation IMO. 
Here is my working version:


 check file foo.log  with path /home/foo.log

     if match
           "^.*ACTION_REQUIRED.*$" then alert

 check file foo_REPEATED.log  with path /home/foo.log
     group repeatedfailure
     if match
           "^.*ACTION_REQUIRED.*$" for 3 cycles then alert



Cheers Ben

On 22.10.2014 10:35, Martin Pala wrote:
> Hello Ben,
>
> i didn't try such configuration but it looks fine and should work ... it 
> depends however what you expect from it. It won't work as plain cross-cycle 
> strings counter, but as indicator that the string showed up again in 3 
> consecutive cycles.
>
> The "foo_REPEATED.log" service condition requires match in 3 consecutive cycles to trigger the alert and it 
> doesn't matter how many matches there were in 1 (partial) cycle: if there are multiple matches in only one test cycle 
> (for example 20x "ACTION_REQUIRED" string), given cycle matched - Monit will record the read position (end of 
> the file) and the next cycle will start from where it stopped before. In order for the next cycle to match, new 
> instance of "ACTION_REQUIRED" string had to be appended to the file again (at least one instance) - then this 
> cycle will match too. And if this will occur 3rd time (again new occurrence of "ACTION_REQUIRED" string in 
> cycle no. 3), then Monit will trigger the alert.
>
> If you need to count the messages and trigger the alert anytime there are 3+ 
> occurrences of the same string (even in the same cycle), it cannot be achieved 
> with this configuration ... it would require new option for the content test 
> (some counter test for the given pattern).
>
> Regards,
> Martin
>
>
> > On 20 Oct 2014, at 15:11, Ben Soot <address@hidden> wrote:
> >
> > Hello,
> >
> > What is the best way to get alerts of repeated file content matches?
> >
> > I have 2 rules one for the same file so i can then distinguish in mmonit the 
> > service to send alerts to different mail addresses.
> >
> > Somehow the alerts for the repeated rule are not triggered... Anybody done sth 
> > like this?
> > also i never got the service group
> >
> > Im using monit 5.4 and mmonit 3.1.2
> >
> >
> > thanks Ben
> >
> >
> > set daemon  120
> > ...
> >
> >
> > check file foo.log  with path /home/foo.log
> >
> >     if match
> >           "^.*ACTION_REQUIRED.*$" then alert
> >
> > check file foo_REPEATED.log  with path /home/foo.log
> >     group repeatedfailure
> >     if match
> >           "^.*ACTION_REQUIRED.*$" within 3 cycles then alert
> >
> >
> >
> > --
> > To unsubscribe:
> > https://lists.nongnu.org/mailman/listinfo/monit-general
>
>
> --
> To unsubscribe:
> https://lists.nongnu.org/mailman/listinfo/monit-general