Multiple Trigger Words

Swatch can do different things for different trigger words.

Create multiple conditions in your configuration file and test them. Here we add two new conditions to /tmp/swatch.conf that watch for the text “success” with a lower-case or upper-case letter S and for the word “error” in upper, lower or mixed-case.

watchfor /trouble/
exec /usr/local/bin/ "<ASTONISHED> Test log reports the following: $_" 1>/dev/null 2>&1
# report the 1st occurrance in a period of 120 seconds
threshold track_by=$1,type=limit,count=1,seconds=120

watchfor /[sS]uccess/ # look for "Success" or "success".
exec /usr/local/bin/ "<NERD> Success is important!" 1>/dev/null 2>&1
# report the 3rd occurrance in a period of 120 seconds
threshold track_by=$1,type=both,count=3,seconds=120

watchfor /error/i # look for "error", case-insensitive.
exec /usr/local/bin/ "<ALIEN> I have detected an error in /var/log/test.log" 1>/dev/null 2>&1
threshold track_by=$1,type=limit,count=1,seconds=120

The text inside of the forward-slashes is a regular expression. You can make matching as complex as it needs to be.

Last modified November 10, 2020