GrayLog 6 - Source Alert

[pmarko (Pa)]

Hello everyone,

My setup - graylog 6.0.3
I have a firewall stream and in this stream 10 firewalls send the logs
Now I would like to know, when a firewall no longer send logs?

I would like to receive an alarm message - SMS or notification

How can I best implement this?
Suggestions?

Thanks!

[patrickmann]

Send mail when Log Input stops

Hello, I’m new around here. I want to create my alarms in Graylog, but I want it to send me an e-mail when my log inputs stop. How can I do this. Thank you for your help in advance.

[pmarko (Pa)]

Thanks, but how can I trigger an alert from an event?

thx

[patrickmann]

https://go2docs.graylog.org/current/interacting_with_your_log_data/alerts.html

[frantz]

The links provided by @patrickmann will help you to create an alert if the Stream has no log, which means all firewall stopped to send logs.
Unfortunately as far as I know it isn’t possible to create a rule to be alerted if only one firewall stop to send logs (or you need to create a specific rule for each firewall but it’s really not handy)

[pmarko (Pa)]

Can anyone tell me what is meant by GrayLog Cluster Alert ?

thx