Triggering Alert On Repeating Occurrences

[kaylani]

I'm reading a log file and I want to identify if certain line ("The system is entering recovery state.", for example) occurs more than once after a given interval (let's say 30 seconds) and resets after another interval (let's say 180 seconds).

I've tried to use count with the triggers, but with count I can only check if the line appeared a number of times in a interval. What I want is to "reset" this timer. Example:

Not triggering:
hh:mm:ss
10:10:10 - The system is entering recovery state.
10:10:12 - Nothing happened.
10:10:15 - The system is entering recovery state.
10:10:12 - Nothing happened.
10:10:20 - The system is entering recovery state.
10:10:22 - The system is entering recovery state.
10:10:23 - The system is entering recovery state.
10:10:24 - Nothing happened.
10:10:30 - Nothing happened.
10:10:40 - Nothing happened.
10:10:42 - Nothing happened.
10:15:23 - The system is entering recovery state.

Triggering:
hh:mm:ss
10:10:10 - The system is entering recovery state.
10:10:12 - Nothing happened.
10:10:24 - Nothing happened.
10:10:30 - Nothing happened.
10:10:40 - Nothing happened.
10:10:42 - Nothing happened.
10:10:45 - The system is entering recovery state.

Thanks in advance for any responses.