From d09f0f841e38ed7142957755c594cac6981adb88 Mon Sep 17 00:00:00 2001 From: m0duspwnens Date: Wed, 7 Oct 2020 11:13:03 -0400 Subject: [PATCH] only send loss if timestamp on data has changed --- salt/telegraf/scripts/zeekcaptureloss.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/salt/telegraf/scripts/zeekcaptureloss.sh b/salt/telegraf/scripts/zeekcaptureloss.sh index b4c09f62b..ac9240110 100644 --- a/salt/telegraf/scripts/zeekcaptureloss.sh +++ b/salt/telegraf/scripts/zeekcaptureloss.sh @@ -2,7 +2,7 @@ # This script returns the average of all the workers average capture loss to telegraf / influxdb in influx format include nanosecond precision timestamp {%- set WORKERS = salt['pillar.get']('sensor:zeek_lbprocs', salt['pillar.get']('sensor:zeek_pins') | length) %} ZEEKLOG=/host/nsm/zeek/spool/logger/capture_loss.log -LASTCAPTURELOSSLOG=/scripts/lastcaptureloss.txt +LASTCAPTURELOSSLOG=/host/nsm/zeek/logs/telegraf_lastcaptureloss.txt if [ -f "$ZEEKLOG" ]; then CURRENTTS=$(tail -1 $ZEEKLOG | jq .ts | sed 's/"//g') if [ -f "$LASTCAPTURELOSSLOG" ]; then