I have configured Windows events to be sent to syslog using a free application called SyslogAgent. I then configured Windows log text files to be pushed over to syslog as info events like DHCP, inet, and logs from my phone system as outlined here - http://itcoop.wordpress.com/2010/12/02/shoretel-events-to-syslog/
Now I’d like to research the possibility of notifying when a rate threshold is violated. Example:
If syslog_rate_of_messages exceed 100 per 900 seconds, notify.
My syslogs are being filtered to go to specific log files via regexp. So, this rate can also be calculated by the number of CRLF’s introduced in the log file as well.
Is there any way to do this native to the Dude?
Thanks!