This is for Graylog 4. It is my understanding that the message count alert condition no longer exists.
I have ~30 source hosts reporting their messages. I’d like to receive an alert when any one of them stops reporting.
I can certainly program 30 separate notifications for EACH of the 30 hosts to Filter & Aggregate and then alert when the count() for each is zero, but is there a simpler way with a single notification and grouping by source and checking for sources not received?
Maybe through a bash script and then sending it to Zabbix. From there I can create a tigger/alert if the number changes. But then how would i tell which node is not send data? Just a thought. Other then that I dont know either. Were still looking for a simple solution.
Thanks for the number of sources idea. We’ve got about 30 sources, so it isn’t out of the question to create 30 notifications, but it seems like a big hole in the Graylog design. Creating additional API reading scripts is certainly possible, but an over-complicated kludge for us.
I think it is weird these threads get automatically closed after 14 days. This would be a great topic to revisit if ever solved by configuration of current capabilities or a new feature.
@gsmith Unfortunately there’s not a built in mechanism for this in the enterprise version either, we use it and ended up crafting our own solution. We couldn’t get the content pack to work the way we wanted either.
Here is a suggestion : Create an event definition that runs every X minutes (define X as you see fit). In aggregation, define a condition based on the card() of the “source” field. If it is anything less than your number of sources, fire an alert.