Deduplication of messages

[linuxgurugamer]

Some of the events I'm monitoring generate multiple messages; for example, the number of users on a system exceeds the trigger multiple times. All we want to see is that it's been exceed, and the number of times it was exceeded.

How can this be done?

Thanks in advance.


JBB

[linuxgurugamer]

More details

We have a few servers which occasionally trigger an event. Now, this is ok, except that when this happens, the trigger goes on and then off many times over the course of a short period of time.

For example, one simple trigger is watching the number of users on a system. We need to know when the trigger level is exceeded, but not every time. What happens is that, using the example of a trigger level of 15, is that we will usually have between 10 and 12 users, but sometimes will go to 16-17. When this happens, it is usually for a short period of time, at which point the count drops below 15, but many times it will then go above 15 a few minutes later. This cycle can happen many time.

While this is a simple example, the issue is significant for some very important triggers we have.

We don't want to get an email for every time this trigger is hit; we would want to get one email over a period of time, at least until it is acknowledged. A daily email is fine, but a hundred emails over the course of a few hours is not; and that is what is happening right now.

Any suggestions?


Thanks in advance



JBB

[mpureka]

I was just coming in to ask this same sort of question - we often have situations where alerts will be repeatedly triggered, generating a lot of needless noise. It would be very valuable to be able to reduce the frequency of alerts for a given event.