Attaching Alerts to Events


(Ayoola Ayooluwa) #1

Hello, I have configured my Graylog alerts to work fine. But it sends only Test messages. I have configured under “Manage Conditions” to set windows event id =4624 for successful logon.

I also created a notification below but when i click on test; it sends me a dummy message.

Ever since i created the conditions and notifications, i have got a lot of successful logons on graylog but i havent rcvd any notification about it in my mailbox. Is it that there’s a place to join the conditions to the particular notification?


(Jan Doberstein) #2

is the condition and the notification mount to the same Stream?


(Ayoola Ayooluwa) #4

yes, they are.

image


(Jan Doberstein) #5

did you notice if the condition is become true (means is triggered)?

Because the notification will only send out if the condition is triggered.


(Ayoola Ayooluwa) #6

Yes, i just did a search on my stream now and i got logs for successful logon. but i didnt get any alert.

image


(Ayoola Ayooluwa) #7

@jan , are you there? i still aint getting alerts and events are dropping


(Ayoola Ayooluwa) #8

@jochen, could u help please?


(Jan Doberstein) #9

and again you think that this is a privat support channel. If you want to have SLA like responses, pay for professional support!

You did not answer my question, that is why i’ll not answer here or make wild guessing what your problem is.


(Ayoola Ayooluwa) #10

sorry i didnt see ur question.

How do i notice if it becomes true?


(Jan Doberstein) #11

Hej @haywhai

if you go to Alerts in your Web page, did you see the alert as “unresolved” or if you go to “show alerts” did you see any alert?


(system) #12

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.