I believe it depends on how much data is being written to the log. If the log is really busy, it could be as little as 1 polling cycle (5 minutes) that the LOG status stays red. It depends on how quickly the bad entries get "pushed" out of the log window size defined in client-local.cfg.
On Jan 30, 2008 11:09 AM, Bill Fischer <mndud3 at gmail.com> wrote:
Hello,
I have clientlocal.cfg configured to collect the log messages I need.
I have hobbit-clientts.cfg configured to watch for the specific messages I need.
One question I have: how long will the status stay RED by default? A couple tests seems to show that the duration of the red status will vary. Some will stay red for just 10 minutes, others stay that way for more than 30 minutes.
I can write a special rule to handle LOG alerts, but I'd rather not have to and if I understood why the duration of the red status seems to be variable, perhaps I don't have to.
-Bill.