[Xymon] Feature Request ~ logfetch

[henrik at hswn.dk]

On Mon, 25 Feb 2013 15:55:06 -0500, Michael Beatty
<Michael.Beatty at sherwin.com> wrote:
> I see the comments made in logfetch.c
> 
> /* Is it ok for these to be hardcoded ? */
> #define MAXCHECK   102400   /* When starting, dont look at more than 100

> KB of data */
> #define MAXMINUTES 30
> #define POSCOUNT ((MAXMINUTES / 5) + 1)
> #define LINES_AROUND_TRIGGER 5
> 
> My answer to this would be, "no".
> 
> Due to various reasons, it is not desirable to run my client more than 
> once every hour.  Therefore, the msgs check for log files is almost 
> useless unless I change these values (and honestly, I'm not even sure 
> that would work as I haven't seen if this would impact anything else).  
> If I ran my client every hour, I would lose 50% of my log data.
> 
> I would like to see where the log check would be dependent on how long 
> of an interval your client is run as opposed to a hard coded 30 minutes.

OK, just to clarify what these are for:

- MAXCHECK is only used when the client has not run before, to avoid 
  searching gigabytes of log data. It does not affect how log files
  are processed during normal client-cycles - that is controlled by the 
  logsize setting in client-local.cfg.
- MAXMINUTES is only used to calculate POSCOUNT.
- POSCOUNT determines how many of the previous client cycles the client
  will include in the client-data as "current logfile data". 

What this means is that the "30" is really a red herring - what matters is
that the client will send data from the logfile generated during the last 7
times the client ran. So if the client runs only once an hour, then you'll
have logdata from the past 6 hours included in the client data.


Regards,
Henrik