I have a log item: log[/var/log/some.log,"FATAL ERROR","us-ascii",100] which update every 30 seconds.
what I'm trying to do is get each FATAL ERROR by mail.
to test it I've setup the following trigger expression:
and an action attache to this trigger.
when more then 1 FATAL ERROR events will enter the log within the 30 second update, the trigger will fire an action more then once and the equal amount of mails will be sent,
BUT the first email will sent will have the ITEM.VALUE equal the first error line and the rest of the emails will have the ITEM.VALUE equa the last line that enter the log withing the 30 second update.
What I would expect is, for each trigger, the action will have the ITEM.VALUE equal the log line that triggered the event.