Hi James,
I would probably approach this using type=Single with a context specific
to the error digits you're interested in, to avoid duplicate
notifications (rather than Singlewiththreshold).
Something like this.
type = Single
ptype = RegExp
pattern = Something bad with a number (\d+-\d+)
context = !bad_event_$1
desc = Bad Event
action = create bad_event_$1 60;\
pipe '%s' /usr/local/bin/sendEmail -f [email protected] -s server -t [email protected] -u
"Bleh" -m "$0"
Thanks,
Aaron Erickson
[email protected]
Zoot Enterprises, Inc. www.zootweb.com
555 Zoot Enterprises Lane, Bozeman, MT 59718
This email, including any attachments, is confidential and may not be
redistributed without permission. If you are not an intended recipient,
you have received this message in error. Please notify us immediately by
replying to this message, and then delete it from your computer. Thank
you.
From:
James Lay <[email protected]>
To:
<[email protected]>,
Date:
07/08/2014 11:06 AM
Subject:
[Simple-evcorr-users] A question on SingleWithThreshold
Hey all,
So I have this type of event:
Jul 7 19:40:02 Something bad with a number 10333-12344
Jul 7 19:40:04 Something bad with a number 10333-12344
Jul 7 19:40:10 Something bad with a number 10333-12344
My rule below works just as I want...I only get one alert:
ype = SingleWithThreshold
ptype = RegExp
pattern = Something bad with a number ([\d-]+)
desc = Bad Event
action = pipe '%s' /usr/local/bin/sendEmail -f [email protected] -s server -t
[email protected] -u "Bleh" -m "$0"
window = 60
thresh = 1
But now say I get this:
Jul 7 19:40:22 Something bad with a number 10333-12344
Jul 7 19:40:34 Something bad with a number 10333-12345
Jul 7 19:40:56 Something bad with a number 10333-12346
This are different, so I want to see all three, however the threshold
kicks in and I only see the first one. How can I change this behavior?
I know I'm missing something, but I'm not sure where to look. Thanks
for any assistance you can give.
James
------------------------------------------------------------------------------
Open source business process management suite built on Java and Eclipse
Turn processes into business applications with Bonita BPM Community
Edition
Quickly connect people, data, and systems into organized workflows
Winner of BOSSIE, CODIE, OW2 and Gartner awards
http://p.sf.net/sfu/Bonitasoft
_______________________________________________
Simple-evcorr-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
------------------------------------------------------------------------------
Open source business process management suite built on Java and Eclipse
Turn processes into business applications with Bonita BPM Community Edition
Quickly connect people, data, and systems into organized workflows
Winner of BOSSIE, CODIE, OW2 and Gartner awards
http://p.sf.net/sfu/Bonitasoft
_______________________________________________
Simple-evcorr-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
