Michael Hale wrote: > Hello, > > I was wondering if there was a way to alarm if a certain output is NOT > seen after a certain amount of time. > > For example, I have a logfile which lists transaction processing - I > want to alarm when nothing is written to that file for a certain > amount of time, or alternately, when either the string "STATUS = 1" or > "STATUS=0" hasn't appeared for a certain amount of time.
hi Michael, yes, the task you have described can be done quite easily. There is a related example in the man page (see http://simple-evcorr.sourceforge.net/sec.pl.html#lbBA), but it can be modified for your purpose: type=Calendar time=* * * * * desc=WAITING FOR STATUS action=event %s type=PairWithWindow ptype=SubStr pattern=WAITING FOR STATUS desc=Status message not seen for a while action=event %s ptype2=RegExp pattern2=STATUS=[01] continue2=TakeNext desc2=Status message has appeared on time action2=none window=300 type=Pair ptype=SubStr pattern=Status message not seen for a while desc=No status message in the log! action=pipe '' mail -s 'STATUS error' r...@localhost ptype2=RegExp pattern2=STATUS=[01] desc2=Status message has appeared again! action2=pipe '' mail -s 'STATUS OK' r...@localhost The first rule triggers STATUS message presence checks every minute by injecting a synthetic event into the event stream. The second rule matches the triggering event and waits for the STATUS message to arrive during the next 5 minutes. If the message is not seen, a fault event "Status message not seen for a while" is created that is matched by the third rule. The third rule sends an error e-mail to the local root, but also sends a mail when the STATUS message appears again. If the window in the second rule is a larger one (say, 2-3 hours), you could send the mail directly from the second rule, in order to produce frequent remainders to the responsible person ;-) hth, risto > > BTW, are there searchable archives of this mailing list available? It > doesn't appear the SourceForge archives for this list allow searching? > -- > Michael Hale > <mh...@transcomus.com > > > Manager of Engineering Support Enterprise > Engineering Group > Transcom Enhanced Services > http://www.transcomus.com > > > > > > > ------------------------------------------------------------------------------ > Stay on top of everything new and different, both inside and > around Java (TM) technology - register by April 22, and save > $200 on the JavaOne (SM) conference, June 2-5, 2009, San Francisco. > 300 plus technical and hands-on sessions. Register today. > Use priority code J9JMT32. http://p.sf.net/sfu/p > _______________________________________________ > Simple-evcorr-users mailing list > Simple-evcorr-users@lists.sourceforge.net > https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users > ------------------------------------------------------------------------------ Stay on top of everything new and different, both inside and around Java (TM) technology - register by April 22, and save $200 on the JavaOne (SM) conference, June 2-5, 2009, San Francisco. 300 plus technical and hands-on sessions. Register today. Use priority code J9JMT32. http://p.sf.net/sfu/p _______________________________________________ Simple-evcorr-users mailing list Simple-evcorr-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
