search

Cacti / plugin_syslog

Syslog Plugin for Cacti
GNU General Public License v2.0
21 stars 16 forks source link

Allow syslog threshold to check current and past events to trigger alert #202

Open bmfmancini opened 1 year ago

bmfmancini commented 1 year ago

The current syslog threshold setup only looks at the messages in the syslog_incoming table this only allows for syslog to check logs that have been sent in the interveral of the syslog poller

for example on a 1 minute polling cycle with a syslog threshold set to 10 the device would have to send the same log 10 times in that minute for the threshold to fire

It would be better to check the saved syslog data to see if the threshold has been breached it would be nice to have a timeframe option say x messages in x minutes/days etc similar to what we have in the thold plugin

TheWitness commented 1 year ago

That could be expensive, but with partitioned tables on a date range, is should be okay.