<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=us-ascii">
<META content="MSHTML 6.00.2900.3354" name=GENERATOR></HEAD>
<BODY>
<DIV><FONT face=Arial>Running Hobbit version 4.2.0 all-in-one patch dated
2007-02-09 10:30<BR>UTC.<BR><BR>OS: Redhat AS 5<BR><BR>I have searched thru the
Hobbit Archive for ways to best pattern match<BR>in log files. What I have is
working to the extent of what I believe<BR>hobbit will support "out of the
box"</FONT></DIV>
<DIV><FONT face=Arial></FONT> </DIV>
<DIV><FONT><SPAN class=581103415-21072008><FONT face=Arial>Has anyone been
able to do the following:</FONT></SPAN></DIV><FONT face=Arial size=2></FONT>
<DIV><BR><FONT face=Arial>1.) In Hobbit today with version 4.2.0 log file alerts
happen once in a<BR>30 minute window even if you have more than one occurrence.
Has anyone<BR>been able to change this behavior to a smaller window? "maybe
4.3.0 has<BR>something new?" <BR><BR>2.) Another feature that I am looking for
is thresholding. If I throw 10<BR>messages "that match" into a log in X time
frame say 15 minutes or 30<BR>minutes and so on I don't want to get notified but
if I throw 11 into<BR>the log I do.<SPAN
class=581103415-21072008> </SPAN>Is there any way to do this?<SPAN
class=581103415-21072008> Another script to do the work and
then</SPAN></FONT></DIV>
<DIV><FONT face=Arial><SPAN class=581103415-21072008>send to another log file
and have hobbit alert on that maybe?</SPAN><SPAN
class=581103415-21072008> </SPAN><BR><BR></DIV></FONT></FONT></BODY></HTML>