What I’m seeing is that I get an alert for my trigger string (which has a timestamp on it), and then I keep getting alerts for the same trigger string (with the same timestamp) for the next 30 minutes. I’m not sure if anything else was append to the log file in that 30 minutes. I stop getting the alerts after 30 minutes and don’t have to wait until the log is rotated for the alert to clear.
Nicole
From: Xymon [mailto:xymon-bounces at xymon.com] On Behalf Of Jeremy Laidman Sent: Monday, October 27, 2014 4:45 PM To: Bill Arlofski Cc: xymon at xymon.com Subject: Re: [Xymon] duration of MSG red status
On 27 October 2014 01:26, Bill Arlofski <waa-hobbitml at revpol.com<mailto:waa-hobbitml at revpol.com>> wrote: I have not tested this, but it would seem to indicate that it would cause the client to send the Xymon server all the lines that match the trigger pattern (regardless of how far back in time they go in the logfile) which should cause the test to stay non-green until the logfile is rotated and no more lines with the trigger pattern exist.
I haven't verified this, but my understanding of how the "logfetch" process works is that it keeps state of where it got up to in each logfile, and for the next (5 minute) round, it starts looking for matches only from that point onwards. This means, if there's a trigger match in the log file, the client will send it to the server in that round only.
J