Simon icon Simon
Flexible server monitoring

Trigger notice once per log entry

I have set up services to check for various events in my system logs. I would like a failure of these services to report a Growl notification. I can get it to work successfully. However, unless I set the Notifier to only trigger once per failure, it will alert me repeatedly for the same event in the logs, over and over. If I change the Notifier to alert me only once per failure, subsequent log entries don't trigger the notification because at no point in the interval between log entries did the test result change to success.

For example, if I have a notifiier set to run each minute, and if the notifier sends me a Growl notice on failure, and I have matching log entries at 8:00 and 8:10, it seems like my two options are:

- have Growl notify me every minute from 8:00 to 8:10 and on into the future
- have Growl notify me of the failure at 8:00 but it won't pick up the failure at 8:10 since the test result hasn't changed between 8:00 and 8:10

Is there a way to make Simon notify once per LOG ENTRY rather than once per failure/success?

Thanks.

David Sinclair's picture

Re: Trigger notice once per log entry

I'm not sure of your exact configuration, but it might be possible to do what you want by including the date of the log entry in the text you examine. Add some extra filters to extract the date & time (probably via a Block filter) and prefix the log entry with it (probably via a Simple Format filter). Then look at that entire text when determining whether a failure occurred (treating it as the error text). So each failure will include the date and time, and thus will be treated as separate failures.

Re: Trigger notice once per log entry

Thanks, David! I will look into this.