Alert condition triggered but can't see why

Graylog Central (peer support)
1

I got a stream that receives messages from server A, Server A is a oracle database

Server A logs a few things, all these outputs are collected by logstash (using jdbc queries) and written to ONE logfile (in json) , filebeat reads it and send it over to our graylog server.

The log contains different keys depending on the type of action monitored
eg.

  • audit logging based on useractivity (sql query on audit table)
  • audit settings on oracle level (select statement to system tables)

the audit logging has about 10 keys that map to each queried column in the audit view,
the audit settings query logs itā€™s values fairly simple as filebeat_key and filebeat_value.

I wrote a alert condition based on
filebeat_key: audit_dest_file AND NOT filebeat_value:/somedir

Iā€™m aware that this value will only become active/change when DB is restarted, but this isnā€™t the issue. The issue is that even when this value didnā€™t change upon the previous log entry, it will trigger an alert. I assume it tries to match the condition on an" audit logging", this entry doesnā€™t contain the fields filebeat_key & filebeat_value so it the condition is TRUE.

What would be the correct way to handle this ? I assume my query string isnā€™t correct. Although when i use this query on my stream as a filter, it wonā€™t show any hits, thus i concluded it wouldnā€™t trigger a TRUE condition as well.

2

Could you provide a screenshot of your alert definition configuration and of the message which has triggered the alert (Donā€™t forget to redact any sensitive info)

3

settings below

2020-03-02 18_06_40-Window
2020-03-02 18_06_40-Window586Ɨ816 70.9 KB

5

2020-03-02 18_06_40-Window
2020-03-02 18_06_40-Window1159Ɨ554 186 KB

6

What version of GL are you running? That is the old alert system.

Have you put the full path of the filebeat_value field in your alert condition or?

AFAIKā€¦

filebeat_value: /oracle/orabck/<REDACTED> will match ā€˜/oracle/orabck/<REDACTED>ā€™ but will not match ā€˜/oracle/orabck/<REDACTED>/audit_sys_operationsā€™
Add a wildcard if you want to exclude that entire directory or put the full path if you just want to exclude the ā€˜audit_sys_operationsā€™ file.

7

Graylog 3.0.2+ is what we are running

the full condition is

filebeat_name: audit_file_dest AND NOT filebeat_value: /oracle/orabck//audit_sys_operations

8

Hmm okayā€¦

If you run that search yourself against the stream, does it also return the undesired message?

Not sure if the space you are putting before the value will have an impact but, you could try removing that as well.

9

it seems that adding quotes did solve the problem

filebeat_name:ā€œaudit_file_destā€ AND NOT filebeat_value:"/oracle/orabck/<REDACTED>/audit_sys_operations"

1 Like
10

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.