We are trying to use mk_logwatch.py to monitor log files in the Windows host, count and volume of files a bit much, like 40 files ranging from a few kilobytes to 20MB, at first it works but we get constant flaps on different files, like “log not present anymore” but actually log file present in the host, this flaps happens for short intervals. We suspect it because of the count of the log files, anyway to optimise it? at least a way to avoid “UNKNOWN” alerts.
Perhaps it’d be an idea to run logwatch asynchronously. Take a look at this: Asynchronous execution
HTH,
Thomas
To be honest, this configuration section not clear for me, like it does not properly explain how I would do it for plugins under windows agent but when I check check_mk.user conf I see:
plugins:
...
# async_start: yes # start plugins asynchronous, this is default
I see other async: yes configs aswell, I think this is default behaviour anyway
I’m sorry, I blatantly overlooked that you were talking about a Windows host, and thus - a Windows
Agent.
Perhaps you can then use asynchronous execution in conjunction with the “cache_age” and/or “timeout” settings for this plugin, as described here: Customizing execution of a specific plug-in
HTH,
Thomas