file content testing

[Tim.Einmahl]

Hi,

I have some comments on the file content testing feature.

I really appreciate it, but I would like to have some more possibilities
in it:

At the moment, when I configure monit like 

check file messages with path /var/log/messages
if match "kernel" then alert

and "set daemon 60"

then I will receive a mail for each match in /var/log/messages.
That means, if there were 100 lines matching in 60 seconds, I would
receive
100 mails, for example from iptables (I can reduce logs with -m limit,
just example)

I would like to have the possibility to receive the matches in one mail
per cycle,
or for a certain number (very high) of matches only a mail where I get
informed about
the number of matches, so I can take a look at the logfile without
getting too large mails.

Example:   check file messages with path /var/log/messages
           if match "kernel" counter lt 100 alert_one_mail
           counter gt 99 alert_only_info

So if there are up to 99 mtaches, I receive one mail including the
matching lines
if there are more than 99 matches, I receive just a notification mail
like

Regex match Service messages 
        Date:        somedate
        Action:      alert
        Host:        somehost
        Description: 'messages' content match kernel <counter> times

What do think about that ?


Best regards and many thanks for monit

Tim