Hi everyone, I’ve been working with Graylog 3.1.1 and have this issue (i will tell onward) so i upgraded to the latest 3.2.4 but still don’t get what it’s wrong: only 1 node I receive syslog messages from routers, so i’m testing sending syslog messages using ‘logger’ from Ubuntu directly to the …

he @maxplay your intention will not work with a vanilla Graylog. Because “output to file” is not given. The log4j is to configure the logging behaviour of Graylog itself. The script notification plugin ( https://docs.graylog.org/en/3.2/pages/alerts.html#legacy-script-alert-notification ) is one ad…

he @maxplay did you have regular inputs that receive messages? How did you configure the event definitions? Graylog will run the events definition search only if it receive messages for/in the given search window of the definition. If no messages are received at all no event search is done.

Hi @jan how are you? Mi input is “syslog udp” and i receive messages normally. Here is part of the Event definition: [image] (i didn’t set: Event Fields, Notifications) Please, i don’t see what could be wrong. As i said before, the messages are displayed ok, but no event is shown, when a New m…

@jan maybe the problem here is also related to the one @DerBeton (found solution?) posted some days ago…they seem to be similar… [image] No Event / Alert fired Graylog Central (peer support) Hey Graylog Community We have a one node Graylog Setup with Docker. Versions: …

Hey @maxplay I haven’t found a better solution yet. Means I’m still using the Random HTTP Message Generator from Graylog to create Random messages every 30 seconds. With this I have at least enough traffic so that Graylog detects events correctly. I’ve also created a custom Stream for this messag…

he @DerBeton , @maxplay that is true - this is an absolute edge case. We wanted to reduce not needed work and so Graylog checks if it has received messages in the period it should search in. Because if not, the event search will not be done. That a graylog does not receive that much messages is most…

Hi @jan , @DerBeton Thanks for your comments! I’m not sure if it is the exactly the same problem we both have: in my case the message arrives OK, and no Event fired, then, after some time, let’s say wait 5 minutes (more than 1 min), receive a new message and the Event related to the first one is f…

Hi again, Well, as i thought, routing those Random HTTP messages into a Stream and then into Pipeline and rule droping: drops the message makes the messages aren’t “get/take” (?) by ElasticSearch so: no effect with Events… So, i’m doing @DerBeton solution: WORKS OK! Is there a way to “not show”…

Hey @maxplay thanks for your update. So your idea to drop the message in the pipeline is quite good but in this case I don’t have to implement this if you say it doesen’t work. Actually I think we have exactly the same issue because when a message enters graylog after the log which should fire an …

[image] DerBeton: So your idea to drop the message in the pipeline is quite good but in this case I don’t have to implement this if you say it doesen’t work. right @DerBeton , it didn’t work @jan is there a way to make a rule send a message with a defined delay? let’s say the rule is executi…

Hi @jan how are you? To sum up, i have 2 questions: is there a way to generate and send a message with a defined delay after you receive a message? is there a way to log to STDOUT to a file other than server.log? Thank you very much! Max!

Events, alerts fired only after a second message arrives

Graylog Central (peer support)

maxplay March 24, 2020, 3:53pm 4

@jan maybe the problem here is also related to the one @DerBeton (found solution?) posted some days ago…they seem to be similar…

Topic		Replies	Views
Graylog 3.3.5 - Some messages in stream do not generate event and notification Graylog Central (peer support)	14	2304	March 26, 2021
Events and alerts not firing Graylog Central (peer support)	3	1202	November 1, 2019
Alert events are being randomly skipped Graylog Central (peer support) alert	4	304	March 30, 2024
No Event / Alert fired Graylog Central (peer support)	0	560	March 9, 2020
Alerts/Events do not trigger Graylog Central (peer support)	54	8554	October 22, 2019

Events, alerts fired only after a second message arrives

Related topics