[Xymon] Feature Request ~ logfetch
henrik at hswn.dk
henrik at hswn.dk
Wed Mar 6 14:55:50 CET 2013
On Mon, 25 Feb 2013 15:55:06 -0500, Michael Beatty
<Michael.Beatty at sherwin.com> wrote:
> I see the comments made in logfetch.c
> /* Is it ok for these to be hardcoded ? */
> #define MAXCHECK 102400 /* When starting, dont look at more than 100
> KB of data */
> #define MAXMINUTES 30
> #define POSCOUNT ((MAXMINUTES / 5) + 1)
> #define LINES_AROUND_TRIGGER 5
> My answer to this would be, "no".
> Due to various reasons, it is not desirable to run my client more than
> once every hour. Therefore, the msgs check for log files is almost
> useless unless I change these values (and honestly, I'm not even sure
> that would work as I haven't seen if this would impact anything else).
> If I ran my client every hour, I would lose 50% of my log data.
> I would like to see where the log check would be dependent on how long
> of an interval your client is run as opposed to a hard coded 30 minutes.
OK, just to clarify what these are for:
- MAXCHECK is only used when the client has not run before, to avoid
searching gigabytes of log data. It does not affect how log files
are processed during normal client-cycles - that is controlled by the
logsize setting in client-local.cfg.
- MAXMINUTES is only used to calculate POSCOUNT.
- POSCOUNT determines how many of the previous client cycles the client
will include in the client-data as "current logfile data".
What this means is that the "30" is really a red herring - what matters is
that the client will send data from the logfile generated during the last 7
times the client ran. So if the client runs only once an hour, then you'll
have logdata from the past 6 hours included in the client data.
More information about the Xymon