Alerts - Repeats notifications every minutes

Graylog Central (peer support)
1

Hallo :slight_smile: ,

I eagerly awaited the Graylog version 2.2.2 with the Option for “Repeat notifications”, with the hope that the old Alert configuration from Graylog could be still used. This was necesarry for example in the Daily mails about Security-Events like Logins / File-Changes.

However, the defined “Grace Period” could not be considered, to this regard, the Daily Mail notifications could not be correctly configured.

For example, the following configuration caused that 15 Mail notifications were sent out for a single message in a stream;

Time Range: 15
Threshold Type: more than
Threshold: 0
Grace period: 15 minutes
Repeat notifications: true

The Grace period was completely ignored and the Alert sent out a notification with every evaluation.

My point of view is that this option should also take into account the Grace Period.

Please advise if I have gotten this completely false or if I have made my configurations wrong. :slight_smile:
Is there an option to regularly send notifications regardless of the Alert status?

Similary: Alert conditions (i don’t want to disturb)

Thanks and Regards
Tobias Lensing

2

Hi Tobias,

Thank you for the detailed account of what you did and your expectations, that helped.

I have been looking into it and it’s a bug. I opened this issue so we can track its progress:
https://github.com/Graylog2/graylog2-server/issues/3579

Cheers,
Edmundo

2 Likes
3

Hi Edmundo,

Thanks alot for the quick response, I am eagerly looking forward to the next update. :grinning:

Cheers,
Tobias

1 Like
4

Hello, I am working on a project what would like Graylog to send a notification right when an alert is triggered instead of every minute. Is there a way to configure that? I noticed Graylog always sends notifications at the same second of every minute.

5

No, alerting is based on scheduled search queries running in a specific interval. While you can reduce the default interval of 60s, I would strongly advise against doing so:

6

Thank you very much for your answer. I will take a look at it.