<html><head></head><body><div style="font-family:Helvetica Neue, Helvetica, Arial, sans-serif;font-size:10px;"><div>Ive an alert for msgs (var/log/messages entries) that I desire to have paged in office hours only<br>Thing is its only linux clients that need this check., not windows clients.<br><br>So if I set a stadard style alerts.cfg entry <br><br><span><div>HOST=* SERVICE=msgs TIME=w:0800:1830 COLOR=red</div><div> MAIL monitor@us.com</div><div><br></div><div>of course if any windows msgs go red (constantly... zzzz) then they will page also, which is not the required outcome.<br><br>There is the option I see of something like<br><br>alerts.cfg:<br><span><div>GROUP=SSSD_MSGS TIME=w:0800:1830 COLOR=red</div><div> MAIL monitor@us.com<br>analysis.cfg</div><div>default section<br><span><div>LOG %/var/log/messages "%TEST" COLOR=red GROUP=SSSD_MSGS [ search string here of course being TEST ]<br><br>but that does exactly the same thing.<br><br>So - aside from adding that LOG line to umpteen individual analysis.cfg entries for each linux server, or a single section listing all the linux servers ... is there a way to curtail this check to only linux servers (or more likely a bunch of hostnames of course). Somewhere it seems we'd have to manulayy maintain the correct "list" of hostnames to be caught - Im just trying to minimise the overhead.<br><br>I had considered using a yellow alert to alert the LOG check... but other "things" also issue yellow alerts and we don;t want to trigger them either.<br><br>I can;t see a way out of this?</div><div><br></div><div>didds</div><div><br></div></span><br><br></div><div><br></div></span><br></div><div><br></div></span><br><br></div></div></body></html>