Rainer, Initial testing looks fine. I'll try some more to see if I can break it.
- Julian On Thu, Aug 7, 2008 at 5:08 AM, Rainer Gerhards <[EMAIL PROTECTED]> wrote: > Julian, > > as you have probably seen in my other post, I have implemented the > functionality. I have now also created a test tarball. I'd appreciate if > you could obtain it from > > http://download.rsyslog.com/rsyslog/rsyslog-3.21.3-Test3.tar.gz > > and give it a try. Read ./doc/rsyslog_conf.html in regard to > $ActionExecOnlyEveryNthTime and $ActionExecOnlyEveryNthTimeTimeout. For > what you intend to do, this should work: > > $ActionExecOnlyEveryNthTime 3 > *.* ..your action.. > > You don't need the timeout, but I have included it for completeness. > Well, actually if I were you I'd think if you really don't need it. Is > it really OK that "three in a row" means one each day? > > Please provide feedback on this feature. > > Thanks, > Rainer > >> -----Original Message----- >> From: Julian Yap [mailto:[EMAIL PROTECTED] >> Sent: Friday, August 01, 2008 12:14 PM >> To: Rainer Gerhards >> Cc: [email protected] >> Subject: Re: Re: [rsyslog] Alert when multiple repeated lines are > found >> >> Roger that Rainer. >> >> Thanks, >> Julian >> >> On Thu, Jul 31, 2008 at 11:58 PM, Rainer Gerhards >> <[EMAIL PROTECTED]> wrote: >> > OK, that greatly simplifies things. Actually, it now boils down to >> > "execute an action only on the n-the time the filter evaluates to >> true". >> > I think this is quite easy to implement, but I must verify that... >> > >> > Rainer >> > >> >> -----Original Message----- >> >> From: Julian Yap [mailto:[EMAIL PROTECTED] >> >> Sent: Friday, August 01, 2008 11:03 AM >> >> To: Rainer Gerhards >> >> Cc: [email protected] >> >> Subject: Re: Re: [rsyslog] Alert when multiple repeated lines are >> > found >> >> >> >> On Thu, Jul 31, 2008 at 10:18 PM, Rainer Gerhards >> >> <[EMAIL PROTECTED]> wrote: >> >> > Just one more re-confirmation: >> >> > >> >> >> What I'm looking for: >> >> >> if $msg == 'This is really bad' happens 3 times in a row then >> >> >> :ommail:;mailBody >> >> >> >> >> >> This would be nice but is not required since the 'This is really >> >> bad' >> >> >> message in my case is very unique: >> >> >> if ($msg == 'This is really bad' and $server == 'server' and >> >> $program >> >> >> == 'program') happens 3 times in a row then :ommail:;mailBody >> >> > >> >> > So you would actually use such a rule. If "this other thing is >> > really >> >> > bad" happened three times, the rule shall not trigger. Is this >> > right? >> >> >> >> Yes, I would use such a rule. It would make what is already an >> >> awesome application even more awesome. :P I am also willing to > test >> >> it out and run the latest development version... Which I'm doing >> >> anyway. >> >> >> >> And yes, what you just wrote is correct. >> >> >> >> - Julian >> > > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog
