<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-reply;
font-family:"Arial","sans-serif";
color:blue;
font-weight:normal;
font-style:normal;
text-decoration:none none;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-GB link=blue vlink=purple><div class=WordSection1><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif";color:blue;mso-fareast-language:EN-US'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif";color:blue;mso-fareast-language:EN-US'><o:p> </o:p></span></p><p class=MsoNormal><b><span lang=EN-US style='font-size:11.0pt;font-family:"Calibri","sans-serif"'>From:</span></b><span lang=EN-US style='font-size:11.0pt;font-family:"Calibri","sans-serif"'> Jeremy Laidman [mailto:jlaidman@rebel-it.com.au] <br><b>Sent:</b> 14 March 2014 22:14<br><b>To:</b> Neil Simmonds<br><b>Cc:</b> xymon@xymon.com<br><b>Subject:</b> Re: [Xymon] Log file monitoring<o:p></o:p></span></p><p class=MsoNormal><o:p> </o:p></p><div><div><div><p class=MsoNormal>On 4 March 2014 00:17, Neil Simmonds <<a href="mailto:neilsimmonds1808@gmail.com" target="_blank">neilsimmonds1808@gmail.com</a>> wrote:<o:p></o:p></p><blockquote style='border:none;border-left:solid #CCCCCC 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-right:0cm'><div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>As far as I can see there is no built in way in Xymon to monitor a log for the number of times a string has occurred in a specified time period.</span><o:p></o:p></p></div></div></blockquote><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>Sure there is. From the client-local.cfg file comments:<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><div><p class=MsoNormal># "linecount:FILENAME"<o:p></o:p></p></div><div><p class=MsoNormal># Monitor the text-based logfile FILENAME, but just<o:p></o:p></p></div><div><p class=MsoNormal># count the number of times certain expressions appear.<o:p></o:p></p></div><div><p class=MsoNormal># This processes the entire file every time. It must<o:p></o:p></p></div><div><p class=MsoNormal># be followed by one or more lines with<o:p></o:p></p></div><div><p class=MsoNormal># "KEYWORD PATTERN"<o:p></o:p></p></div><div><p class=MsoNormal># KEYWORD identifies this count. You can use any string<o:p></o:p></p></div><div><p class=MsoNormal># except whitespace. PATTERN is a regular expression<o:p></o:p></p></div><div><p class=MsoNormal># that you want to search for in the file.<o:p></o:p></p></div></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>I use this to monitor the count of "xfer-in" and "xfer-out" messages on my DNS servers. There's already a graphs.cfg definition called [lines] that presents them nicely in a graph.<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>J<o:p></o:p></p></div><div><p class=MsoNormal><span style='color:blue'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif";color:blue'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif";color:blue'>II’ve just had a chance to look at this and it still doesn’t fir my original requirements. I want to count the number of lines matching a regex within a specific time period. So for example I might want to alert if I get 10 warning messages in 30 minutes. <o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif";color:blue'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif";color:blue'>Built in Xymon functionality does not seem to give me a way of doing this.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif";color:blue'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif";color:blue'>I’m looking into Simple Event Correlator as suggested by Henrik as a solution for this but it seems a little heavy solution for a simple requirement. I’m hopeful other requirements will occur in the future to justify the time spent on SEC,<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif";color:blue'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif";color:blue'>Given the fact that once people hear of the capability they’ll come up with all sorts of ways of using it, I’m guessing it will get used.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif";color:blue'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif";color:blue'>Neil.<o:p></o:p></span></p></div></div></div></div></div></body></html>