Hello Ben, i didn't try such configuration but it looks fine and should work ... it depends however what you expect from it. It won't work as plain cross-cycle strings counter, but as indicator that the string showed up again in 3 consecutive cycles.
The "foo_REPEATED.log" service condition requires match in 3 consecutive cycles to trigger the alert and it doesn't matter how many matches there were in 1 (partial) cycle: if there are multiple matches in only one test cycle (for example 20x "ACTION_REQUIRED" string), given cycle matched - Monit will record the read position (end of the file) and the next cycle will start from where it stopped before. In order for the next cycle to match, new instance of "ACTION_REQUIRED" string had to be appended to the file again (at least one instance) - then this cycle will match too. And if this will occur 3rd time (again new occurrence of "ACTION_REQUIRED" string in cycle no. 3), then Monit will trigger the alert. If you need to count the messages and trigger the alert anytime there are 3+ occurrences of the same string (even in the same cycle), it cannot be achieved with this configuration ... it would require new option for the content test (some counter test for the given pattern). Regards, Martin > On 20 Oct 2014, at 15:11, Ben Soot <[email protected]> wrote: > > Hello, > > What is the best way to get alerts of repeated file content matches? > > I have 2 rules one for the same file so i can then distinguish in mmonit the > service to send alerts to different mail addresses. > > Somehow the alerts for the repeated rule are not triggered... Anybody done > sth like this? > also i never got the service group > > Im using monit 5.4 and mmonit 3.1.2 > > > thanks Ben > > > set daemon 120 > ... > > > check file foo.log with path /home/foo.log > > if match > "^.*ACTION_REQUIRED.*$" then alert > > check file foo_REPEATED.log with path /home/foo.log > group repeatedfailure > if match > "^.*ACTION_REQUIRED.*$" within 3 cycles then alert > > > > -- > To unsubscribe: > https://lists.nongnu.org/mailman/listinfo/monit-general -- To unsubscribe: https://lists.nongnu.org/mailman/listinfo/monit-general
