Alerting/Notification when certain sources are not reporting

[gsmith]

@dahacker
hello,
A quick search and I found these. I think its possible but I havent tried it yet. Hope this helps.

Content Pack - Event Source Not Sending Logs

Notification alert if device is not sending log

Hi Team, we are facing some issue in the notification, In our setup, we are getting 300 network device logs but the issue is that if any device stops the sending log in Graylog server due to some reason so how we can know in Graylog. we are also monitoring our service and port, but please help on same how we can resolve the same issue.

Failed login sources alerting

The way I approached this was to have a dedicated stream for that particular dataset and then create a Message Count alert on it so that if the count is 0 after X minutes, send a notification. I also setup a Dashboard to monitor my forwarders and data over time (5 mins, 1 hr, 8hrs, 1day, etc.). I do the “source” in one panel and a data “type” in another - it provides a view of what what received by the server over time and let’s me know if something stopped forwarding. If you do something like…

Event definitions and alert if no logs graylog 3.2.5

Hi ! I’ve about 30 sources for my graylog and i want to generate an alert if some sources no longer sends logs for a given period of time. On my graylog it works if a create one stream and one event definition for each sources but i want to improve this way Can I do the same with only one stream and one event definitions ? I try on the “all messages” stream’s : search within the last 5 min, execute search every 5 min If count(source) <= 0 but it doesn’t work, what i’m doing wrong ? Lastly…