Hello All,
I'm working on monitoring a /var/log/messages, which is updated nearly every
10 seconds with a message from a HADR application.
I have the context set on that file to /var/log/messages, and I have a window
set to 1 day in seconds, but SEC is not ignoring subsequent matches. Instead, I
am getting the action fired off just as often as the message is appearing in
/var/log/messages....
Here is my definition:
type=SingleWithSuppress
ptype=RegExp
pattern=.*([0-9]{2}:[0-9]{2}:[0-9]{2}).*hadr.*\sReturning\s1.*
context=[_FILE_EVENT_/var/log/messages]
desc=As of $1, this host is currently primary.
action=pipe '$0%.nl --- %s --- $+{_inputsrc}' /bin/cat >>
/var/log/failover-status_sec
window=86400
No matter what value I put for the window, it is ignored...
I am using the /etc/secrc file, which has some other definitions:
[...]
#error monitoring
-conf=/etc/sec/error-monitor.sec
[...]
​# failover status monitoring
-conf=/etc/sec/failover-status.sec
# Include /var/log/messages for additional monitoring
-input=/var/log/messages​
My thought is that maybe it is using the "window" option from another conf
file...? Or something along those lines..?
------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot
_______________________________________________
Simple-evcorr-users mailing list
Simple-evcorr-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
