# Notification alert if device is not sending log

**URL:** <https://community.graylog.org/t/notification-alert-if-device-is-not-sending-log/18811>\
**Category:** Graylog Central (peer support)\
**Created:** [February 16, 2021, 6:44am UTC](https://community.graylog.org/t/notification-alert-if-device-is-not-sending-log/18811 "2021-02-16T06:44:28Z")\
**Posts on this page:** 18\
**Page:** 1

<div class="post-metadata">

**Author:** ![Shyambihari](https://avatars.discourse-cdn.com/v4/letter/s/ed8c4c/32.png) [@Shyambihari](https://community.graylog.org/u/Shyambihari)\
**Post date:** [February 16, 2021, 6:44am UTC](https://community.graylog.org/t/notification-alert-if-device-is-not-sending-log/18811/1 "2021-02-16T06:44:28Z")

</div>

Hi Team,

we are facing some issue in the notification, In our setup, we are getting 300 network device logs but the issue is that if any device stops the sending log in Graylog server due to some reason so how we can know in Graylog.  
we are also monitoring our service and port, but please help on same how we can resolve the same issue.

---

<div class="post-metadata">

**Author:** ![aaronsachs](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/aaronsachs/32/7180_2.png) [@aaronsachs](https://community.graylog.org/u/aaronsachs)\
**Post date:** [February 16, 2021, 12:38pm UTC](https://community.graylog.org/t/notification-alert-if-device-is-not-sending-log/18811/2 "2021-02-16T12:38:47Z")

</div>

Hi there,

We have a content pack for this exact thing. See [Graylog Knowledge Base - Content Pack - Event Source Not Sending Logs](https://graylog.zammad.com/help/en-us/13/53). Give that a shot and let me know if that ends up working for you.

---

<div class="post-metadata">

**Author:** ![Shyambihari](https://avatars.discourse-cdn.com/v4/letter/s/ed8c4c/32.png) [@Shyambihari](https://community.graylog.org/u/Shyambihari)\
**Post date:** [February 18, 2021, 6:34am UTC](https://community.graylog.org/t/notification-alert-if-device-is-not-sending-log/18811/3 "2021-02-18T06:34:36Z")

</div>

Hi Aaronsachs,

Thanks for your Response,

While installing the content pack, I am getting some error  
Please find the below mention error.

Installing content pack failed with status: Error: cannot POST [http://192.168.1.35:9000/api/system/content\_packs/d21a07c7-9611-4e8d-9313-c93841d47ab7/1/installations](http://192.168.1.35:9000/api/system/content_packs/d21a07c7-9611-4e8d-9313-c93841d47ab7/1/installations) (500). Could not install content pack with ID: d21a07c7-9611-4e8d-9313-c93841d47ab7

---

<div class="post-metadata">

**Author:** ![Shyambihari](https://avatars.discourse-cdn.com/v4/letter/s/ed8c4c/32.png) [@Shyambihari](https://community.graylog.org/u/Shyambihari)\
**Post date:** [February 23, 2021, 6:01am UTC](https://community.graylog.org/t/notification-alert-if-device-is-not-sending-log/18811/4 "2021-02-23T06:01:25Z")

</div>

please reply on this , how we can resolve the same

---

<div class="post-metadata">

**Author:** ![aaronsachs](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/aaronsachs/32/7180_2.png) [@aaronsachs](https://community.graylog.org/u/aaronsachs)\
**Post date:** [February 23, 2021, 1:31pm UTC](https://community.graylog.org/t/notification-alert-if-device-is-not-sending-log/18811/5 "2021-02-23T13:31:11Z")

</div>

The error you provided doesn’t tell us much. Are you doing this as an admin user? What version of Graylog are you using?

---

<div class="post-metadata">

**Author:** ![Shyambihari](https://avatars.discourse-cdn.com/v4/letter/s/ed8c4c/32.png) [@Shyambihari](https://community.graylog.org/u/Shyambihari)\
**Post date:** [February 24, 2021, 6:06am UTC](https://community.graylog.org/t/notification-alert-if-device-is-not-sending-log/18811/6 "2021-02-24T06:06:43Z")

</div>

thanks for reply.

we are using Graylog v3.0.2+1686930,  
we are also using admin user , we have just install the content pack , we are getting below error

 ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/e/e78afd5956412a5f1d974b809fb34b0be404dbc6.png)

Please check ,

---

<div class="post-metadata">

**Author:** ![aaronsachs](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/aaronsachs/32/7180_2.png) [@aaronsachs](https://community.graylog.org/u/aaronsachs)\
**Post date:** [February 24, 2021, 12:42pm UTC](https://community.graylog.org/t/notification-alert-if-device-is-not-sending-log/18811/7 "2021-02-24T12:42:25Z")

</div>

I don’t think that content pack will work with anything less than 3.2. If you’re on 3.0.2, that’s coming up on 2 years old

 ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/7/7f4fe81292efd413307f78d25e403ca9343e4fc7.jpeg)

We’ve made a lot of improvements to the product in a most 2 years, so I’d recommend upgrading to something more recent if you want to take advantage of that content pack.

---

<div class="post-metadata">

**Author:** ![Shyambihari](https://avatars.discourse-cdn.com/v4/letter/s/ed8c4c/32.png) [@Shyambihari](https://community.graylog.org/u/Shyambihari)\
**Post date:** [February 24, 2021, 1:02pm UTC](https://community.graylog.org/t/notification-alert-if-device-is-not-sending-log/18811/8 "2021-02-24T13:02:00Z")

</div>

can you please guide how we can upgrade our system without any fault,  
because it should be running , it is in production , so please suggest ,

---

<div class="post-metadata">

**Author:** ![aaronsachs](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/aaronsachs/32/7180_2.png) [@aaronsachs](https://community.graylog.org/u/aaronsachs)\
**Post date:** [February 24, 2021, 2:24pm UTC](https://community.graylog.org/t/notification-alert-if-device-is-not-sending-log/18811/9 "2021-02-24T14:24:57Z")

</div>

We have documents describing the upgrade process [here on our docs site](https://docs.graylog.org/en/4.0/pages/upgrade.html). Those will be your best resource.

---

<div class="post-metadata">

**Author:** ![Shyambihari](https://avatars.discourse-cdn.com/v4/letter/s/ed8c4c/32.png) [@Shyambihari](https://community.graylog.org/u/Shyambihari)\
**Post date:** [February 25, 2021, 7:00am UTC](https://community.graylog.org/t/notification-alert-if-device-is-not-sending-log/18811/10 "2021-02-25T07:00:28Z")

</div>

please confirm can we install the content pack for silent source in the open source version if yes so please suggest. if no what we can do to achieve the same in the 3.0.2 version because the system is in production we can not do bigger change which can affect our server.  
Please help us to resolve the same.

---

<div class="post-metadata">

**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\
**Post date:** [February 25, 2021, 2:36pm UTC](https://community.graylog.org/t/notification-alert-if-device-is-not-sending-log/18811/11 "2021-02-25T14:36:33Z")

</div>

he @Shyambihari

no this content pack runs (currently) only with the abilities that Enteprise enables. The event correlations to be precise.

---

<div class="post-metadata">

**Author:** ![lmontesoro](https://avatars.discourse-cdn.com/v4/letter/l/e99b99/32.png) [@lmontesoro](https://community.graylog.org/u/lmontesoro)\
**Post date:** [March 1, 2021, 1:10pm UTC](https://community.graylog.org/t/notification-alert-if-device-is-not-sending-log/18811/12 "2021-03-01T13:10:24Z")

</div>

Hi @jan , @aaronsachs !

I need to alert about if device is not sending logs, this content pack works in open source edition?

Thanks!

---

<div class="post-metadata">

**Author:** ![Shyambihari](https://avatars.discourse-cdn.com/v4/letter/s/ed8c4c/32.png) [@Shyambihari](https://community.graylog.org/u/Shyambihari)\
**Post date:** [March 2, 2021, 1:06pm UTC](https://community.graylog.org/t/notification-alert-if-device-is-not-sending-log/18811/13 "2021-03-02T13:06:18Z")

</div>

Hi @jan

Please help on this

---

<div class="post-metadata">

**Author:** ![lmontesoro](https://avatars.discourse-cdn.com/v4/letter/l/e99b99/32.png) [@lmontesoro](https://community.graylog.org/u/lmontesoro)\
**Post date:** [March 2, 2021, 8:32pm UTC](https://community.graylog.org/t/notification-alert-if-device-is-not-sending-log/18811/14 "2021-03-02T20:32:04Z")

</div>

Hi! the link expired! I need the JSON, or can i find it in website?

---

<div class="post-metadata">

**Author:** ![aaronsachs](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/aaronsachs/32/7180_2.png) [@aaronsachs](https://community.graylog.org/u/aaronsachs)\
**Post date:** [March 2, 2021, 11:01pm UTC](https://community.graylog.org/t/notification-alert-if-device-is-not-sending-log/18811/15 "2021-03-02T23:01:05Z")

</div>

I’ve updated the link–please note @jan 's reply here [Notification alert if device is not sending log - #11 by jan](https://community.graylog.org/t/notification-alert-if-device-is-not-sending-log/18811/11). The content pack makes use of the Graylog’s correlation engine, which is available in Graylog Enterprise.

---

<div class="post-metadata">

**Author:** ![lmontesoro](https://avatars.discourse-cdn.com/v4/letter/l/e99b99/32.png) [@lmontesoro](https://community.graylog.org/u/lmontesoro)\
**Post date:** [March 3, 2021, 12:11am UTC](https://community.graylog.org/t/notification-alert-if-device-is-not-sending-log/18811/16 "2021-03-03T00:11:35Z")

</div>

Hi @aaronsachs , thanks for you reply!

Is there an alternative for this type of alerts using the open source version? I need to control the log holes

---

<div class="post-metadata">

**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\
**Post date:** [March 3, 2021, 12:37pm UTC](https://community.graylog.org/t/notification-alert-if-device-is-not-sending-log/18811/17 "2021-03-03T12:37:11Z")

</div>

he @lmontesoro

with a plain vanilla Graylog you only have the option to query Graylog regular, by script or via your monitoring system to check if the known devices are sending messages or not.

This would even allow you to have different rates you check that per device. But you would need to make this for every device as enterprise is build to make your live easier this kind of check is possible only with the enterprise package.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [March 17, 2021, 12:38pm UTC](https://community.graylog.org/t/notification-alert-if-device-is-not-sending-log/18811/18 "2021-03-17T12:38:11Z")

</div>

Closed on March 17, 2021, 12:38pm UTC

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.
