Why or how if I got this conditions on my alert event, the events just accumulate and send all notification alerts every hour?. I want to received quickly after query search and found a hit.
that’s not happend… that’s why i’m asking… and sorry I rectify… this happend every 30min not 1hour as before but anyway… it’s 30min later after event… .
did you notice that we already have some threads about the topic? Did you checked if your environment has the same source of problem? Did you checked if that will be fixed in the upcoming bugfix release?
It might have multiple reasons and you need to find the root in YOUR environment yourself, we can only give guidance by guessing and from what you have provided, guessing is impossible.
I have the same problem. Alert mail notifications are accumulated and sent once in a while, like 40 minutes after Alerts fired. All this started after upgrade to 3.1.
you should first check the events you have configured logical and check if you have the latest version (3.1.3 at the time of writing) as this include some fixed …
What do you mean by “logical”? I have 2 facts:
1st fact that Alerts are generated in Graylog in time and according to expected logic and I see them in Graylog.
2nd fact is that Notifications submission to the mail server happened 40 min after the Alert happened, submission happened in a batch.
I updated to 3.1.3 (was 3.1.2) yesterday. Yet, I would like to add more logging as if the problem repeats - greylog logs have pretty much no info.
fromt he previous given information it was not visible that the event is create in time and with the given logic but that the notification is having an issue.
Did you checked in your Mail server logs if that messages was received in time but delivered later? Does the “test notification” you can start in the Graylog UI is delivered directly?
Hi Jan,
Yes, I checked my mail server. As I mentioned, the mails were submitted to the mail server from Graylog with the great delay after Alert generation.
Test notifications usually worked fine (immediate arrival), but I have not tried them recently, and now I upgraded and restarted the server.