I'm trying to watch Apache logs for the absence of an event that should occur hourly. For instance it could be a string like: 126.96.36.199 GET /backup.tar.gz
It looks like existing code does not do this (looked at swatch and monit). I'm thinking the right solution is to write my own script which rereads the entire apache log hourly, but looks at timestamps. I'm just wondering if the solution is already out there.