Attaching Alerts to Events

Graylog Central (peer support)
1

Hello, I have configured my Graylog alerts to work fine. But it sends only Test messages. I have configured under “Manage Conditions” to set windows event id =4624 for successful logon.

image
image.png1891×182 18.3 KB

I also created a notification below but when i click on test; it sends me a dummy message.

image
image.png859×636 26.7 KB

Ever since i created the conditions and notifications, i have got a lot of successful logons on graylog but i havent rcvd any notification about it in my mailbox. Is it that there’s a place to join the conditions to the particular notification?

2

is the condition and the notification mount to the same Stream?

4

yes, they are.

image

5

did you notice if the condition is become true (means is triggered)?

Because the notification will only send out if the condition is triggered.

6

Yes, i just did a search on my stream now and i got logs for successful logon. but i didnt get any alert.

image

7

@jan , are you there? i still aint getting alerts and events are dropping

8

@jochen, could u help please?

9

and again you think that this is a privat support channel. If you want to have SLA like responses, pay for professional support!

You did not answer my question, that is why i’ll not answer here or make wild guessing what your problem is.

10

sorry i didnt see ur question.

How do i notice if it becomes true?

11

Hej @haywhai

if you go to Alerts in your Web page, did you see the alert as “unresolved” or if you go to “show alerts” did you see any alert?

12

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.