I have a missing events problem that I am trying to detect and I can't seem to resolve the reliability problem. I want to run a calendar every 5 minutes to detect whether I have an outage. I have logs that arrive mostly regular.. 1 transaction per minute. The regularity of the logs are dependent upon success of many things such as collector activity, SQL server activity, etc. as a result, the activity to remove the 5 minute context is not reliably kicking it off. What do I do to make the dectection a little more loose? I think that the answer is something like make the calendar event expiration time longer.. action=event 60 context_name becomes action=event 120 context_name The configuration example I am working on is included below.
Unrelated feature request: I would like a feature to specify a regular repeating calendar event ala the Vixie cron style.. every 5 minutes time=0,5,10,15,20,25,30,35,40,45,50,55 * * * * becomes: time=60/12 * * * * every 1 minute time=0,1,2,3,4,5,6,7,8,9,10,11,......58,59 * * * * becomes: time=60/60 * * * * Please advise, Tim Peiffer Networking and Telecommunications Services University of Minnesota/NorthernLights GigaPOP # ----- detect missing events ----- # missing events (no events) indicates a service failure # When no activity within 5 minutes, declare down. # Ref: Lisa2004 paper by John Rouillard # rule 1: report a missing event, or log successful detection type=PairWithWindow desc=%Hostname MACTrack Service failure report ptype=regexp pattern=service_5_minute action=logonly %Hostname MACTrack Service run failure (missing events) detected at %t ptype2=regexp2 pattern2=(\S+) MACdatabase.pl \S+ Processed NET.(\d+)\.0?(\d+):0?(\d+):0?(\d+) at (\d+)[EMAIL PROTECTED](\d+):0?(\d+):0?(\d+) TUARN = \(\d+\/\d+\/\d+\/\d+\/(\d+)\) desc2=found $1 mactrack service log trace continue2=TakeNext action2=logonly window=15 # rule 2: trigger the detection operation at 60min/12 +120 sec type=calendar desc = start searching for service traces at 60min/12 + 2 min time=0,5,10,15,20,25,30,35,40,45,50,55 * * * * action=event 120 service_5_minute ------------------------------------------------------------------------- Check out the new SourceForge.net Marketplace. It's the best place to buy or sell services for just about anything Open Source. http://sourceforge.net/services/buy/index.php _______________________________________________ Simple-evcorr-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
