Hi Mike.
Fast reply, and I would have to check it out, but I believe you just need
to create a short-lived context (say half an hour, or one hour), and then
reset it when errors arrive. When errors stop being logged, your context
will eventually end and you'll be ready to receive a new alert if it
happens.
Let's see:
type=Single
ptype=RegExp
pattern=error
context=IGNORE_ERRORS
desc=$0
action=set IGNORE_ERRORS 1800
type=Single
ptype=RegExp
pattern=error
desc=$0
action= <whatever you use to alert you>; \
create IGNORE_ERRORS 1800
The first rule will catch the 'error' lines while the IGNORE_ERRORS
context exists, and reset it to 1800 seconds. The second one only is
executed when there's no IGNORE_ERRORS context, and will report it to you
and create the context with a lifetime of 1800.
Atentamente,
Josep Abenza MartÃ
Arquitectura WEB, Liberty Seguros
Tlf. 93 489 05 00 - Ext. 61605
[EMAIL PROTECTED]
Risto Vaarandi <[EMAIL PROTECTED]>
Enviado por: [EMAIL PROTECTED]
08/05/2008 23:08
Para
[email protected], [EMAIL PROTECTED]
cc
Asunto
[Simple-evcorr-users] Fwd: Do action on event and then ignore events.
I am forwarding this message to the list - it was
accidentally sent to the list admin.
br,
risto
> > From: [EMAIL PROTECTED]
> To:
> <[EMAIL PROTECTED]>
> Date: Thu, 8 May 2008 06:06:39 -0700
> Subject: Do action on event and then ignore events.
>
> G'day all,
>
> We have a process that sometimes goes mad...
>
> The log file starts to fill up with errors that have
> the string 'error'.
> Normally the process writes nothing to the log file
> (or very little)
>
> What I have at the moment is, report on the first
> error and then ignore all others for 24 hours.
>
> What I would like is
> report first error
> ignore all further errors until we have not had an
> error for x minutes
>
> What happens is,
> we get an email of the error
> we fix the error
> error stops
> but if it goes wrong again we don't get another
> error until the 24hrs has expired.
>
> Does that make sense?
>
> --
> 'ooroo
>
> Mike...(:)-)
> ---------------------------------------------------
> Email: [EMAIL PROTECTED] o
> Work: + 44 (0)1344 392538 o /////
> Mob: + 44 (0)7785 762976 /@ `\ /) ~
> Bv: 7-5070 > (O) X< ~
> You need only two tools. `\___/' \) ~
> A hammer and duct tape. \|\
> If it doesn't move and it should use the hammer.
> If it moves and shouldn't, use the tape.
> ===================================================
> For Tektronix legal entity info and registration
> details goto http://www.tek.com/entities
> ---------------------------------------------------
>
>
____________________________________________________________________________________
Be a better friend, newshound, and
know-it-all with Yahoo! Mobile. Try it now.
http://mobile.yahoo.com/;_ylt=Ahu06i62sR8HDtDypao8Wcj9tAcJ
-------------------------------------------------------------------------
This SF.net email is sponsored by the 2008 JavaOne(SM) Conference
Don't miss this year's exciting event. There's still time to save $100.
Use priority code J8TL2D2.
http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone
_______________________________________________
Simple-evcorr-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
-------------------------------------------------------------------------
This SF.net email is sponsored by the 2008 JavaOne(SM) Conference
Don't miss this year's exciting event. There's still time to save $100.
Use priority code J8TL2D2.
http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone
_______________________________________________
Simple-evcorr-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
