Logfile monitor - trigger on substring occurring x minutes.

[kjetil_maland]

Hi, have run into a litte trouble getting log monitor to work.

We have a few logfiles we have set up an Item for and are collecting data as expected. we grab all lines with Error or Warn in the severity part of the log line. So far so good.

But then we want to have triggers reacting to substrings on these data.
have read a few forum posts and have nearly gotten this to work.

{Server1:log[E:\Logs\mylog.log,"\[[0-9]{1,}\] ERROR|\[[0-9]{1,}\] WARN"].count(10m,Invalid,like)}>4

which seems to work as expected raicing the trigger if Invalid occurs more than 4 times in the last 10 minutes.

I do not know if/why we need to have the same regexp in the trigger as the on the item, but that is a different matter

But when no new data is coming into the item the trigger will not go down.
And if I try to add

&{Server1:log[E:\Logs\mylog.log,"\[[0-9]{1,}\] ERROR|\[[0-9]{1,}\] WARN"].nodata(10m)}=0

I get an error mesage: Check expression part starting from "4&

What am I messing up here?

[kjetil_maland]

Ok i got it sorted here.
Was the need to separate the elements in ()

so this seems to work.

((({Server1:log[E:\Logs\mylog.log,"\[[0-9]{1,}\] ERROR|\[[0-9]{1,}\] WARN"].count(10m,Invalid,like)}>4)) 
and
({Server1:log[E:\Logs\mylog.log,"\[[0-9]{1,}\] ERROR|\[[0-9]{1,}\] WARN"].nodata(10m)}=0))

Triggers if:
we see Invalid more than 4 times in the last 10 minutes.
And
we have received new lines (data) in the last 10 minutes.