<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">Hello,<br>
<br>
</div>
<blockquote cite="mid:000001cf36e2$e346f1e0$a9d4d5a0$@gmail.com"
type="cite">
<meta http-equiv="Content-Type" content="text/html;
charset=ISO-8859-1">
<meta name="Generator" content="Microsoft Word 15 (filtered
medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"Bookman Old Style";
panose-1:2 5 6 4 5 5 5 2 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Arial","sans-serif";
color:windowtext;
font-weight:normal;
font-style:normal;
text-decoration:none none;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
<div class="WordSection1">
<p class="MsoNormal"><span
style="font-size:10.0pt;font-family:"Arial","sans-serif"">Hi
all,<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:10.0pt;font-family:"Arial","sans-serif""><o:p> </o:p></span></p>
<p class="MsoNormal"><span
style="font-size:10.0pt;font-family:"Arial","sans-serif"">As
far as I can see there is no built in way in Xymon to
monitor a log for the number of times a string has occurred
in a specified time period. Is this something that other
people would find useful? (even if it was only a count of
occurrences within the last 30 minutes and not a
configurable time). <o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:10.0pt;font-family:"Arial","sans-serif""><o:p> </o:p></span></p>
<br>
</div>
</blockquote>
This is a useful feature, but I doubt if I will use it if
implemented in Xymon.<br>
<br>
I've written two custom scripts which do just this type of data
collection. One script counts the number of denied licence requests
from the FLEXlm log file (one log file per product), the other one
counts the number of DHCP discovers, requests etc. from the ISC
dhcpd log file.<br>
<br>
Both scripts use quit different counting strategies. The first
script counts the number of denied license request since the start
of this year. The result is fed into RRD, using a DS of type DERIVE
with a minimum of zero. The minimum suppresses the negative spike at
each new year.<br>
<br>
The second script starts reading the log file at the location where
it stopped the last time. This is a faster method, but it introduces
small errors. Some (small) parts of the log file can be scanned
twice or some (small) parts are never scanned, depending on the
moment the file size (which is the starting point for the next pass)
is retrieved.<br>
<br>
Both scripts do something special with fast repeating entries: if
two or more license requests from one requester for one particular
product are denied within two seconds the set of di=enials is
counted as one denial, and hosts which send many DHCP requests are
reported. Hence the doubt if I will use a similar functionality in
Xymon.<br>
<br>
Regards,<br>
Wim Nelis.<br>
<br>
<br>
<br>
<HR><font size=2 color="#00467F"><I><span lang=EN-US>
The NLR disclaimer is valid for NLR e-mail messages.</span></I>
<p>
This message is only meant for providing information. Nothing in this e-mail message amounts to a contractual or legal commitment on the part of the sender.</p>
<p>This message may contain information that is not intended for you. If you are not the addressee or if this message was sent to you by mistake, you are requested to inform the sender and delete the message. Sender
accepts no liability for damage of any kind resulting from the risks inherent in the electronic transmission of messages.<br></p>
</font><HR>
</body>
</html>