09-25-2013 11:12 AM
We currently have SiteScope 11.22 installed on RHEL.
I was wondering if it was possible to create a log file monitor that when there is a match it goes into error state,
but since the log file monitor is configured to never read the log file from the beginning, sometimes the log file will
run and try to read the log file and then turn into good status because it read 0 lines and there were 0 matches.
Is it possible to configure the log file monitor so that when it reads 0 lines that it stays in the previous state, so in this case it would be an error state?
Any advice on this is very much appreciated.
09-25-2013 11:36 AM
Help me understand your question a little better. I take it you're expecting that after an error (match), the next time SiteScope reads the log there will be zero (0) lines, and you wish for it to stay in "error" status.
Is that correct?
09-25-2013 11:39 AM
Thanks for the reply.
Correct. Basically we have the log file monitor running every 10 minutes, but the log will not necessarily populate every 10 minutes, may be longer. So after an error(match) state, the next time SiteScope reads the log, it may be zero (0) lines, and therefore I wish the monitor to stay in "error" status.
09-25-2013 12:31 PM
Take a look at "New Calculated Metric" form. It has the ability to retain previous values through a regular expression.
Since SiteScope thresholds deal with absolutes, using the Calculated Metric might be able to retain the value of the previous monitor run (#previous()). A threshold could be set based on the previous monitor run, and stay in error.
I'm really reaching on this one :)