# Failed login sources alerting

**URL:** <https://community.graylog.org/t/failed-login-sources-alerting/1936>\
**Category:** Graylog Central (peer support)\
**Tags:** sidecar, nxlog, nodatanx\
**Created:** [August 2, 2017, 10:44am UTC](https://community.graylog.org/t/failed-login-sources-alerting/1936 "2017-08-02T10:44:16Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Magneton](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/magneton/32/1609_2.png) [@Magneton](https://community.graylog.org/u/Magneton)\
**Post date:** [August 2, 2017, 10:44am UTC](https://community.graylog.org/t/failed-login-sources-alerting/1936/1 "2017-08-02T10:44:16Z")

</div>

Dear All,

I have a test Graylog server setup with a test windows domain. Logs are shipped using NXLog community to the Graylog server in GELF format using a TCP connection.

Is there a way to get an alerts when a log source stops sending

Any help greatly appreciated.

Magneton

---

<div class="post-metadata">

**Author:** ![billmurrin](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/billmurrin/32/42_2.png) [@billmurrin](https://community.graylog.org/u/billmurrin)\
**Post date:** [August 2, 2017, 7:47pm UTC](https://community.graylog.org/t/failed-login-sources-alerting/1936/2 "2017-08-02T19:47:10Z")

</div>

> [@Magneton](#):
>
> st Graylog server setup with a test windows domain. Logs are shipped using NXLog community to the Graylog server in GELF format using a TCP connection.
> 
> Is there a way to get an alerts when a log source stops sending
> 
> Any help greatly appreciated.
> 
> Magneton

The way I approached this was to have a dedicated stream for that particular dataset and then create a Message Count alert on it so that if the count is 0 after X minutes, send a notification.

I also setup a Dashboard to monitor my forwarders and data over time (5 mins, 1 hr, 8hrs, 1day, etc.). I do the “source” in one panel and a data “type” in another - it provides a view of what what received by the server over time and let’s me know if something stopped forwarding. If you do something like that, just make sure you adjust the cache time on the widget so that it is not the default 60 seconds for the bigger queries.

---

<div class="post-metadata">

**Author:** ![Magneton](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/magneton/32/1609_2.png) [@Magneton](https://community.graylog.org/u/Magneton)\
**Post date:** [August 10, 2017, 3:51pm UTC](https://community.graylog.org/t/failed-login-sources-alerting/1936/3 "2017-08-10T15:51:08Z")

</div>

Thanks for your help, I will try it out

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [August 24, 2017, 3:51pm UTC](https://community.graylog.org/t/failed-login-sources-alerting/1936/4 "2017-08-24T15:51:34Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.