From 1106b2bf96a9c3771bc8f78e6e9757d2179ac698 Mon Sep 17 00:00:00 2001 From: m0duspwnens Date: Wed, 7 Oct 2020 11:15:10 -0400 Subject: [PATCH] only send loss if timestamp on data has changed --- salt/telegraf/scripts/zeekcaptureloss.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/salt/telegraf/scripts/zeekcaptureloss.sh b/salt/telegraf/scripts/zeekcaptureloss.sh index ac9240110..e11b2a0eb 100644 --- a/salt/telegraf/scripts/zeekcaptureloss.sh +++ b/salt/telegraf/scripts/zeekcaptureloss.sh @@ -2,7 +2,7 @@ # This script returns the average of all the workers average capture loss to telegraf / influxdb in influx format include nanosecond precision timestamp {%- set WORKERS = salt['pillar.get']('sensor:zeek_lbprocs', salt['pillar.get']('sensor:zeek_pins') | length) %} ZEEKLOG=/host/nsm/zeek/spool/logger/capture_loss.log -LASTCAPTURELOSSLOG=/host/nsm/zeek/logs/telegraf_lastcaptureloss.txt +LASTCAPTURELOSSLOG=/host/opt/so/log/telegraf_lastcaptureloss.txt if [ -f "$ZEEKLOG" ]; then CURRENTTS=$(tail -1 $ZEEKLOG | jq .ts | sed 's/"//g') if [ -f "$LASTCAPTURELOSSLOG" ]; then