<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
</head>
<body bgcolor="#ffffff" text="#000000">
I have setup both types of logfile monitoring. In client-local, I have:<br>
<br>
log:/some/application/logfile.log:10240<br>
ignore MARK<br>
linecount:/some/application/logfile.log<br>
timeouts:.*Session.Timeout.*<br>
<br>
The <b>log</b> directive makes the Hobbit client parse a particular
application log.<br>
The <b>linecount</b> directive is being used so that Hobbit graphs the
number of "Session Timeout" errors in a particular application log.<br>
<br>
My hobbit-clients.cfg includes this, for example:<br>
<br>
LOG /some/application/logfile.log %.*Session.Timeout.* color=yellow<br>
LOG /some/application/logfile.log %.*Session.Error.* color=red<br>
<br>
The above two entries allow me to get Hobbit alerts if there are any
session timeouts in the log (yellow alert), or if there are any errors
in the log (red alert).<br>
<br>
Now, what I need, is the ability to set alerts based upon HOW MANY
timeouts or errors are in the log. I'm thinking this regex should work
(it does according to pcretest):<br>
<br>
LOG /some/application/logfile.log %(.*Session.Timeout.*){10,} color=red<br>
<br>
The above *should* set a red condition if there are 10 or more Session
Timeouts in the log, or at least in the part of the log that Hobbit
received.<br>
<br>
My question is...does Hobbits logfile parsing perform the multi-line
regex or single? If it applies the regex to the entire logfile, my
regex should work. If it only tests each line individually, it will
not.<br>
<br>
Other thoughts on Hobbits log monitoring:<br>
* I think it makes more sense for the the "linecount" to be in
hobbit-clients.cfg instead of client-local.cfg<br>
* Its sort of confusing that "linecount" does not require a % in front
of a regex, like everything else in Hobbit does (at least according to
the man pages)<br>
* Why do we need client-local.cfg at all? Couldn't these directives
all be done via hobbit-clients.cfg, and any clients that are using
local instead of server-side config would then use client-local.cfg?<br>
* If Hobbit indeed does parse line-by-line and such my regex would
fail, perhaps linecount could have an additional parameters to set an
alert if the linecount is exceeded, something like: linecount filename
pattern <optional minimum yellow count> <optional minimum red
count><br>
</body>
</html>