[monit] Having two "if changed" statements

[Moshe Cohen]

Hi,
Below is a monitrc excerpt.
The intention was that if xxx.log changed once in a while I should just get an alert, but if it changes too often (3 in 5) the check should be unmonitored in order to stop
endless alerts, under the assumption that such frequent changes point to a recurring problem, which is tru in my case.

It does not work.
Effectively, only the 2nd line takes effect and I only get the message about unmonitoring. If I have changes once in a while, I get no alerts at all.
Without the 2nd line, I do get an alert on each change.
How do I make both lines work?


check file xxx.log with path /home/mm/logs/xxx.log
        if changed timestamp then alert
        if changed timestamp for 3 times within 5 cycles then unmonitor



Moshe