21 May
2015
21 May
'15
7:37 p.m.
Is it possible to get an alert only when 'cannot connect to remote server' shows up more than 5 times in last 5 mins?
So kind of an improvement over LOG on analysis.cfg with a COUNT field like below
LOG /var/log/daemon.log %cannot.connect.to.remote.server COUNT>5
Thanks
-- Asif Iqbal PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu A: Because it messes up the order in which people normally read text. Q: Why is top-posting such a bad thing?