[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [hobbit] How long should a LOG status be red?
- To: hobbit (at) hswn.dk
- Subject: Re: [hobbit] How long should a LOG status be red?
- From: "Gary Baluha" <gumby3203 (at) gmail.com>
- Date: Thu, 31 Jan 2008 11:40:43 -0500
- Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:to:subject:in-reply-to:mime-version:content-type:references; bh=rQLvncp3Y9PQHZV7+GWIjWdJQxudl4EO728vg6tj2pA=; b=ldiufedz5l8LX7fVNEMOeAjGs60EwMWrBqMLBGPBJET6pmS3iW6OQ6FHXBnDF9fk9AQplBXIQhvA8ZqGJRNG2GHk0+163B54AX7c6F79rtKg2OWhXUIrOqIYGIdeL1j8nP8kduaZCcytIhnm8R5uDBZHRBgHa3mtVb2Ew9WQUd8=
- Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:to:subject:in-reply-to:mime-version:content-type:references; b=w0sjV0hr8PJE+p7ts1alprupElbASpdutItGGvGg4iMlCiarnksa63rVtWax2V3/ZumImwYX8Ird78MTpaY4c/idUF8G0s8EOWaAaJ2ZEgwKBhagshji+eNpdnRaJopxaKaVXRdwcEjCENA+tBL+INs+e5eo5G7f/toczGhA6tY=
- References: <4812be720801300809y5e35d74cr89b62446afc3dbc4 (at) mail.gmail.com>
I believe it depends on how much data is being written to the log. If the
log is really busy, it could be as little as 1 polling cycle (5 minutes)
that the LOG status stays red. It depends on how quickly the bad entries
get "pushed" out of the log window size defined in client-local.cfg.
On Jan 30, 2008 11:09 AM, Bill Fischer <mndud3 (at) gmail.com> wrote:
> Hello,
>
> I have clientlocal.cfg configured to collect the log messages I need.
>
> I have hobbit-clientts.cfg configured to watch for the specific messages I
> need.
>
> One question I have: how long will the status stay RED by default? A
> couple tests seems to show that the duration of the red status will vary.
> Some will stay red for just 10 minutes, others stay that way for more than
> 30 minutes.
>
> I can write a special rule to handle LOG alerts, but I'd rather not have
> to and if I understood why the duration of the red status seems to be
> variable, perhaps I don't have to.
>
> -Bill.
>