Agent log file limit

[BDiE8VNy]

If I've understood you correctly, then you were already on the right track.
Update the Log item to collect all relevant strings:

log[path/to/file,(string1|string2|string3),,,skip,\1]

On condition that the patterns 'string1', 'string2' and 'string3' cannot be a sub string of something unrelated, the item will extract and collect the respective matching string parts.
Then you can count the respective 'strings' individually in a trigger expression:

{log[path/to/file,(string1|string2|string3),,,skip,\1].count(5m,string1,eq)} > 10 or {log[path/to/file,(string1|string2|string3),,,skip,\1].count(5m,string2,eq)} > 90 or {log[path/to/file,(string1|string2|string3),,,skip,\1].count(5m,string3,eq)} > 50

This trigger fires if string1 occurs more than 10 times or strings2 more than 90 times or string3 more than 50 times during the past five minutes.

[Manish]

Hi,
Thanks a lot. All is well now.

[Manish]

Hi,

sorry I am opening this case again with you because your solution works and now I am having some other problem with the same log file and I hope you only can guide me further.

I am monitoring log file and its working great, however I have problem in recovery state. I am searching specific string from log file and if its count greater than 50 in last 5 min then I get email alert however even though that error goes alert does not go untill next occurance of same string comes and its count less than 50. I want some solution on this.