Logmon thresholds and samples

[Legacy User]

I posted some questions in the past regarding logmon's ability to alarm on the number of alarms found by setting up an auto operatior to take an action on number of alarms generated(the suppression count in the NAS).  

 

My goal was to find an event in a log file that occured X times per scan... and to generate an alarm when that threshold was breached over X samples/scans.  I ended doing some what seems like crazy functions in the NAS to alarm on these conditions.  

 

I was also on a call with Nimsoft the other day where they said the probe can do all that.  The conversion didn't lend itself to discuss that fully, but I noticed there is a new logmon probe (v3.21) has some new threshold options in the watcher/alarm tab.  Has anyone tried doing the above or similar without having to due a bunch of crazy clunky NAS functions?  And perhaps used the threshold option in the logmon probe?  Documentation doesn't seem to be too helpful and playing around with those options don't really yeild anything of value in this scenario.

 

Thanks, Chris.

[Anon Anon]

You can set the match threshold parameter to alarm on the number of matches:

 

 

 

[Legacy User]

Is it possible to alarm if the number of matches has been breached over x number of samples over say, 20 minutes?  Also, I noticed that it appears there is no way to change those alarm messages.. for the specific messages indicating that the match count has been breached, there's no way to change that?

[Anon Anon]

You might set up a second profile exactly the same as the first.  Have one run every minute (or however often you want) for the count of alarms, then the second will run every 20 minutes (or how often you want the breach alarm).  This will give you 2 separate QoS points, but might do what you are wanting.