cumulative count

[iFriend]

Hello,
first of all, thank you for this great software and this forum!

Sorry if this is a dumb question, but pls do you have any advice on how to do best the following:
Create a graph that shows the total sum of all occurrences read from a log file.
I was looking at "log.count", but it only returns the last value of the last portion of the log file. What I want is that the whole log file is counted every time, so that the resulting graph would be "growing" and show the full total every time and the full sum at the end of the day of course.

Thank you very much in advance!

[iFriend]

hello everybody, please I badly need some input on this one. Could anybody help out?
And of course also appreciate any advice if you thing something is wrong with the question.

[iFriend]

I still have no solution for this, so please allow to come back to this. Please, any help here?

[gofree]

I dont think this is possible with default agent setup - see here

but there is a line that might help you aout - it will be a nasty thing anyway so what you could do in theory modify the log ( somehow - cron ? ) in a way that agent will reread it always as a new one

second option maybe some calculated item working with log.count / calculated item = last(#1)value + last(#2)value - that might work maybe


notable lines on log monitoring from docu:


Do not modify the last modification time of log files with 'touch' utility, do not copy a log file with later restoration of the original name (this will change the file inode number). In both cases the file will be counted as different and will be analyzed from the start, which may result in duplicated alerts.

Whenever the log file becomes smaller than the log size counter known by the agent, the counter is reset to zero and the agent starts reading the log file from the beginning taking the time counter into account.

[iFriend]

thank you very much gofree! Will try the calculated idea!

I also just found ideas like:
{hostA:log[c:\path\to\log.log, ERROR].count(10m,"exact string","ne")}>4
{hostA:log[c:\path\to\log.log, ERROR].count(10m, ERROR)}>4&{hostA:log[c:\path\to\log.log, ERROR].nodata(10m)}=0
Currently trying to figure that out too...