How to view Critical Events

Graylog Central (peer support)
,
1

Hello,
Currently I am receiving about 100-200 logs per minute from about 20 servers and filtered them out from Application to Security and then Warnings to Errors for each winlogbeat_level. I am a bit comfortable with sorting out the logs but I have ran into a wall head-on.

I am attempting to create an alert for only critical issues that require immediate attention but I have yet to come across a log that meet those requirements, therefore I have no information on how I should filter critical messages out.

How would I go about this? Should I just sit and look at the logs until I come across one? I actually have been doing that for the past 2 days.

Thank you.

2

The winlogbeat_level would equal “Critical”, right? Here is one I had:
image

on message:
The system has rebooted without cleanly shutting down first. This error could be caused if the system stopped responding, crashed, or lost power unexpectedly.

Or if you are looking to figure out event ID’s to watch for, here is a quick list:
https://www.ultimatewindowssecurity.com/securitylog/quickref/Default.aspx

1 Like
3

I have yet to encounter a critical winlogbeat_level so I will definitely create a stream to first test that case.

Thanks for the advice!

4

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.