[Top][All Lists]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

file content testing

From: Tim.Einmahl
Subject: file content testing
Date: Thu, 28 Dec 2006 10:27:57 +0100


I have some comments on the file content testing feature.

I really appreciate it, but I would like to have some more possibilities
in it:

At the moment, when I configure monit like 

check file messages with path /var/log/messages
if match "kernel" then alert

and "set daemon 60"

then I will receive a mail for each match in /var/log/messages.
That means, if there were 100 lines matching in 60 seconds, I would
100 mails, for example from iptables (I can reduce logs with -m limit,
just example)

I would like to have the possibility to receive the matches in one mail
per cycle,
or for a certain number (very high) of matches only a mail where I get
informed about
the number of matches, so I can take a look at the logfile without
getting too large mails.

Example:   check file messages with path /var/log/messages
           if match "kernel" counter lt 100 alert_one_mail
           counter gt 99 alert_only_info

So if there are up to 99 mtaches, I receive one mail including the
matching lines
if there are more than 99 matches, I receive just a notification mail

Regex match Service messages 
        Date:        somedate
        Action:      alert
        Host:        somehost
        Description: 'messages' content match kernel <counter> times

What do think about that ?

Best regards and many thanks for monit


reply via email to

[Prev in Thread] Current Thread [Next in Thread]