Logfile Trigger Configration

[olsonlance]

I cannot seem to find the correct configuration to handle the following need...

Sample Logfile Being Monitored:
ID,Date,Task,Status,...
12345,12/12/12 12:12:12,Task 1, SUCCESS
12345,12/12/12 12:12:12,Task 2, SUCCESS
12345,12/12/12 12:13:12,Task 1, SUCCESS
12345,12/12/12 12:13:12,Task 2, SUCCESS
12345,12/12/12 12:14:12,Task 1,FAILURE <-- Generate Problem "Task 1 Failure"
12345,12/12/12 12:14:12,Task 2, SUCCESS
12345,12/12/12 12:15:12,Task 1,FAILURE
12345,12/12/12 12:15:12,Task 2, SUCCESS
12345,12/12/12 12:16:12,Task 1, FAILURE
12345,12/12/12 12:16:12,Task 2, FAILURE<-- Generate Problem "Task 2 Failure"
12345,12/12/12 12:17:12,Task 1,SUCCESS <-- Close Problem "Task 1 Failure" - lasted 3m
12345,12/12/12 12:17:12,Task 2, SUCCESS <-- Close Problem "Task 2 Failure" - lasted 1m
12345,12/12/12 12:18:12,Task 1, SUCCESS
12345,12/12/12 12:18:12,Task 2, SUCCESS


I have configured a trigger to monitor this logfile and open separate problem events for each FAILURE pattern with tagging in the trigger for the associated Task. This creates multiple failures if two tasks fail at the same time which is desired. However, since the task may fail on subsequent executions and if the if the failures persist, each subsequent failure for the same task creates duplicate problem entries. If the issue persists long enough, the monitoring dashboards fill with 100's of entries related to the same initial problem.



I would like to limit the problems to one per each Task. I attempted to setup a suppression within the event correlation configuration and while this resulted in one entry per problem event, the recovery conditions in the trigger were not seen and the problems never closed without manual updates.

Any suggestions?

Thanks.

[olsonlance]

Thanks will do.

[cyber]

Logfiles ... ugh.. use 2 separate triggers, one for task1 and one for task2 and do not create multiple problems.