time based alerts

[nicolasg]

Hi,

I'm trying to configure two alerts based on time conditions and need some help:

#1
the first one I want to get alerted if a process is not running for more than 7 days then to raise an alert :

Item :

proc.num[,,,/usr/bin/chef-client]

Trigger :

{my_app:proc.num[,,,/usr/bin/myprocess].max(7d)}<1

#2
The second check I'm monitoring the checksum of a file that another process is updating when it runs successfuly. I want to get alerted if the file hans't changed for more than an hour to raise a trigger :

item :

vfs.file.cksum[/var/log/last_successful_run]

Trigger :

{my_app:vfs.file.cksum[/var/log/last_successful_run].diff(0)}=0

Unfortunately none of the alerts are working correctly... any help appreciated.

[coreychristian]

Your first item seems like it should fire if the number of processes is 0 for 7 days. Is the trigger not firing at all? Do you actually have values for that item?

For the second item, I don't believe Diff works over a time period.

We actually use file time stamps instead of checksum changes to do this type of monitoring, here is an example of a trigger I created to alert if a file hasn't been updated in 36 hours.

{Template Baseline Linux:vfs.file.time[/logfile/name.log].now(0)}-{Template Baseline Linux:vfs.file.time[/logfile/name.log].last(0)}>108000