Alerts - Repeats notifications every minutes

Graylog Central (peer support)
1

Hallo :slight_smile: ,

I eagerly awaited the Graylog version 2.2.2 with the Option for ā€œRepeat notificationsā€, with the hope that the old Alert configuration from Graylog could be still used. This was necesarry for example in the Daily mails about Security-Events like Logins / File-Changes.

However, the defined ā€œGrace Periodā€ could not be considered, to this regard, the Daily Mail notifications could not be correctly configured.

For example, the following configuration caused that 15 Mail notifications were sent out for a single message in a stream;

Time Range: 15
Threshold Type: more than
Threshold: 0
Grace period: 15 minutes
Repeat notifications: true

The Grace period was completely ignored and the Alert sent out a notification with every evaluation.

My point of view is that this option should also take into account the Grace Period.

Please advise if I have gotten this completely false or if I have made my configurations wrong. :slight_smile:
Is there an option to regularly send notifications regardless of the Alert status?

Similary: Alert conditions (i donā€™t want to disturb)

Thanks and Regards
Tobias Lensing

2

Hi Tobias,

Thank you for the detailed account of what you did and your expectations, that helped.

I have been looking into it and itā€™s a bug. I opened this issue so we can track its progress:
https://github.com/Graylog2/graylog2-server/issues/3579

Cheers,
Edmundo

2 Likes
3

Hi Edmundo,

Thanks alot for the quick response, I am eagerly looking forward to the next update. :grinning:

Cheers,
Tobias

1 Like
4

Hello, I am working on a project what would like Graylog to send a notification right when an alert is triggered instead of every minute. Is there a way to configure that? I noticed Graylog always sends notifications at the same second of every minute.

5

No, alerting is based on scheduled search queries running in a specific interval. While you can reduce the default interval of 60s, I would strongly advise against doing so:

6

Thank you very much for your answer. I will take a look at it.