[logs] Re: Does swatch throttling currently work?

Previous message: Kelly Brown: "[logs] Re: Does swatch throttling currently work?"
In reply to: Kelly Brown: "[logs] Does swatch throttling currently work?"
Next in thread: Taneli Otala: "[logs] Re: Does swatch throttling currently work?"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

sean@private

Kelly,

Here is what I had to do to get throttling to work:

watchfor /Logon Failure:/
        mail addresses=sean\@example.com,subject="Logon Failure"
        throttle=00:00:10,key=/.*Workstation Name:(.*)\^I.*/

The format is slightly different than what I found in the manual.

Sean

On Thursday 23 March 2006 15:29, Kelly Brown wrote:
> Hello all:
>
> I'm trying to set up some swatch alerts that use throttling.  I can
> not get it to work.
>
> perlcode my $sa_regex = 'smtp1\.corp.* Service unavailable';
> watchfor /$sa_regex/
>          echo
>          throttle 0:10:00,use=$sa_regex
>
> I've also tried this:  throttle threshold=5:120,repeat=no
>
> It also does not work.  I get an alert for every message.
>
> I've read in various places that Throttle.pm is broken and in other
> places that it was fixed.  I'm running 3.1.1-2 from a debian package.
>
> Does anybody know if this thing is supposed to work?  I don't want to
> keep banging my head on it if it's known not to work.
>
> Thx
> -K

-- 
Sean Higgins, sean@private
http://www.systura.com - "Where information becomes knowledge."
_______________________________________________
LogAnalysis mailing list
LogAnalysis@private
http://lists.shmoo.com/mailman/listinfo/loganalysis