MonitorWare Knowledge Base

I am working on installing and configuring WinSyslog 6. It is currently set up to forward messages to an e-mail address based on their Syslog Priority (in this case < 4 ). Shortly after setting up the system and pushing the server address to our devices, we discovered that a fan on a router that is located on an entirely different continent has failed.

That's all well and good except that the device sends a Priority1 Syslog every three minutes, which means that our service desk is getting e-mails every three minutes about a fan in Eastern Asia that has failed.

While for the moment I have simply excluded this message from the forwarding, is there a way to make WinSyslog wait before performing an action if a message is a repeat message from within a certain period of time? For Example, if WinSyslog gets a "dead fan" message at 9 AM and sends an e-mail about it, can I make it wait until 9 PM before sending an e-mail again even if it keeps getting "dead fan" messages?

Thanks

Hi,

you can define a minimum waittime for an action before fireing again.
This option can be found in the global conditions. However currently this would affect all sources triggering this rule, but in your case I assume you want it based on source or message.

The current rolling beta of WinSyslog has a new feature in the Filter Conditions which allow you to bound the Global Conditions on a property, like %source% or %msg%. Using %source% for example would drop all messages from the affected syslog device, until the minimum waittime is over.

You can also decide to wait for the next minor update of the current WinSyslog Version which will be soon. Otherwise take a look into the Rolling Beta Thread here.

best regards,
Andre Lorbach