Re: Monitoring logs

[Martin Pala]

> On 07 Mar 2016, at 13:22, Petra Humann <address@hidden> wrote:
> 
> Hello Martin,
> 
>> Am 04.03.2016 um 09:37 schrieb Petra Humann <>:
>> 
>> from monit.log:
>> 
>>> [CET Mar  2 08:23:11] info     : 'syslog' start on user request
>>> ...
>>> [CET Mar  2 08:23:41] error    : 'syslog' content match [Mar  2 06:28:25 
>>> host kernel: matching content
>>> ….
>>> [CET Mar  2 08:23:41] error    : 'syslog' content match [Mar  2 07:54:44 
>>> host kernel: matching content
>> 
>> 
>> Is it possible to scan the file not from beginning, but from 'syslog‘ 
>> starting time
>> to get only new matching entries?
> 
> may be it is solved with issue #316 in https://mmonit.com/monit/changes/.
> A very old monit version (5.9.) is running on Debian Jessie LTS.
> 
> Thank you.
> Petra Humann


The issue #316 is not related to it - the file position was always saved to the 
state file, so monit then scans the file including changes which were added 
while monit was stopped.

If you want to skip the content which was added before monit started, monit 
5.15 or newer will do that if you'll remove the state file before monit starts 
(currently there is no other way for reseting the file position).

Regards,
Martin