Is there a way to tell monit to alert me if there are more than X errors (e.g. lines matching "ERROR") in a log file in a certain time?
My use case would be: errors sometimes appear in my log file (i.e. network errors, remote server hiccup etc) and they are not critical. But I'd like to be notified if there is a spike because that would require a quick investigation (e.g. botched deploy, newly introduced bug).
Ideally I'm thinking of something like
check file myapplog with path /var/myapp.log every 2 cycles
if lines matching "ERR" > 10% then alert
I think I can get this by writing an external script and then doing something like
check program cer with path /usr/local/bin/checkerrorrate.sh
if status != 0 then alert
but I'm wondering if there is a better option.