Graylog 3.2 alerts

Hi there,

I have setup raw plaintext udp input in order to test some alerts. I was able to send events and search it

echo “Hello Graylog” | nc -w 1 -u 5555

After that I have setup following alert filter message:Hello OR source: and I’m able to see the result on Filter Preview

My Group by Field(s) is message and source

The condition is:

IF count() message > 2 OR count() source >2 ANY ANY

Everthing seems ok, but when I send some events there is no alerts

Notification part is working ok, there is no errors in log file
Should I install something additional for alerts ?

I found that the problem is only with Aggregation of results reaches a threshold

For example I have tried to setup alert for 2 or more events 5140(S, F): A network share object was accessed.

I use SubjectUserName as filter as you can see from attached screen, and count(), but without any success

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.