Reduce email notification if same/similar message

Graylog Central (peer support)
1

Hi dear community.

I’m configuring email notifications in graylog to receive level 0 and 1 alerts for my cisco switchs.
this is working fine. but it happens quite often that a same message is triggered several time a day which is generating many useless emails.

I would like if possible to only receive one email for a specific message per day.

for instance : these are emails i’m receiving :

image
image1115×585 26.1 KB

messages with red rectangle are sent many times a day but it’s exactly the same information. I would like to only have 1 message and skip the next ones until the next day or next week for instance.

is that possible please?

Thank you for your help.

//minouch

2

Hey @minouch

When creating the Event Definition there are settings under Notification that can make it happen.
There called Grace Period and Message Backlog. This ties into your Search within the last && Execute search every which is under filter & Aggregation.

3

Hi Gsmith,
thank you for your reply.
so in my “Filter & Aggregation” tab i have set it this way :

image
image1029×925 54.4 KB

then on the Notifications tab, I have appliled a 24h Grace period :

image

so if I understand it correctly, each individual alert message will be sent only once per 24h ?
regarding the message backlog, should I let it unticked ? I’m not sure to understand the behaviour of message backlog actually, if I tick it and put “1” for instance, does that mean I will only receive 1 alert message from Graylog in 24h ? or does that mean 1 message maximum per different alert in 24h ?

Thank you for your help :slight_smile:

//Minouch

4

hey @minouch

Like it states “Number of messages to be inclued in the notifications”. If you do not want a message to be included in alert then you all good, If you want a message or messages then tick the box and you can add how many messages you would like per email.

5

Hi Gsmith.
I have put 1 in messages as it was before but keeping 24 hours as grace period doesn’t work I think because I only receive one notification in 24hours which is not what I want. I would like each notifications to be received once/24h. so as an example if I receive 2 different messages, I will receive them both but the next same message i’m receiving I will only receive them 24h after.
My english is not perfect, so I’m not sure if i’m clear enough :slight_smile: please if i’m not clear, let me know i’ll try to show with pictures.
maybe solution is to play with “keys” here.
thank you.
//minouch

6

Hello @minouch

Ok i understand now. You may need to configure Create Events for Definition if.. This is under “Filter & Aggregation”.

If you have multiple message coming in within 24 hours but only want one in a 24 hours then perhaps
Using “Group by Field/s” then below that setting configure Create Events for Definition
Something like this:

image
image1873×680 41.4 KB

This states if the count is greater the 0 send alert.

All the steps.

  • Search within the last 1 minute ( this will search back intime for 1 minute)

  • Execute search every 1 minute (this will execute every minute to search back intime for 1 minute)

  • Group by fields “source”

  • Events for Definition if Count() is greater > then 0 then alert.

  • Notification setting grace priod 24 hour (wait 24 hours to send another alert)

  • Alerts and Events

7

Thank you Gsmith for your answer and apologise for the delay, I was travelling and couldn’t test it.
I just applied settings as you described :

image
image1246×768 49.8 KB

I will monitore it on the incoming days if it works.

Thank you

8

Another question actually, in my case, shouldn’t I use “Message - String” instead of “source - string” ? cause the way I understand it, it’s based on source name or IP so I could miss some messages if another event is triggered with same IP ?

9

Message-String is the message field, most do dont if you st count how many message you have. I probably could come up with another suggestion if you could post what you trying to achieve.

10

Hi Gsmith,
I’m afraid it’s not working properly.
I only received one email today from graylog matching the requirements :

image
image1221×256 11.4 KB

but on graylog side, I received 9 messages in total (matching the same requirements) but only 4 different messages (see colors red green yellow and blue below)

image
image1581×349 53.5 KB

idealy what i’m trying to achieve is to only receive one message per color and per day. so most likely in this situation i would have received only 4 emails. but in my case with settings you suggested me, I only received one email which is the top one in the list with blue rectangle.

Thank you.

11

Hey @minouch

Easiest way I know of is if you want 4 emails per “color”, then I would suggest filter them out into different streams /w rules.

Example:

Stream: Standby 1 stack-manager( blue)
Stream: Switch 2 Hotspot (Yellow)
Stream: Link Changed 3 stack-manager (green)
Stream: Switch 5 Hotspot (Red)

Or However you want to separted them, either by device, events, warnings, errors, etc…

Create Event Definition for each one of the streams, then attach a common Notification to each on the the Event Definition.

Since you get one alert per day now, as stated from above you should be good.

12

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.