Hi. We have huge directory, which we wanna to sync from policyhub not often then 1 hour, but also with delay after that hout (to split all hosts in this hour to random time).
body action if_elapsed(x)
{
ifelapsed => "$(x)";
expireafter => "$(x)";
}
vars:
"delay" int => "60";
files:
"/path/to/file":
comment => "...",
action => if_elapsed($(delay)),
copy_from => ...;
That worked perfectly (but all hosts synced this directory in one 10minutes interval).
So i decided to replace
with
"delay" int => randomint(30,90);
In theory in this way we should have some randomization at if_elapsed and oveload once per hour should dissapear.
In practice i have "/path/to/file" executed 9/10 times (due to tcpdump).
When "/path/to/file" not executed, i can at cf-agent -Iv output strings like:
Nothing promised here [last.domain.files.action.ifelapsed.expir] (YY/78 minutes elapsed)
with always random integer instead of YY.
When i using static integer - YY replaced with number of minutes, which looks like time from last execution of "/path/to/file" input.
Probably, it s a bug.
Anyway - are there another methods to do such logic? Once per hour/halfour + random delay for only one input.
Thanks.