the check file statement doesn't handle the times/cycles setting in a proper way.
check file filelog with path "/var/log/file.log" if not exist then exec "/usr/bin/touch var/log/file.log" if match "error" then alert if match "count" for 3 times within 5 cycles then alert
Monit accept the statements in line 4.
[CEST May 12 18:33:17] error : 'filelog' content match: count
But I get an "alert" all the time the match "count" or "error" was found in the file. Unfortunately monit (5.25.2) seems to ignore the times/cycles limits but accept the statements.
From my point of view monit should send an "alert" for "count" for three or more matches in five cycles only.
Sorry, but I can't find some more detail information in the wiki.
Is this a bug?
In general a limit for content matches seems to be useful, I think.