"Unknown alert" problem

Graylog Central (peer support)
1

Hi all,
I clicked “show all alerts” button and fund an unknown alert on a stream. The details of the condition show “The condition was most likely deleted since the alert was triggered,no detail was available.”. However, this alarm condition does exist. It may be that I have deleted and re-created an alarm condition with the same conditions on this stream.
Is there any way to make it display normally? Or only delete the stream and re-create a new stream, and then re-create alarm conditions based on this stream?

2

He @Shelin

could you please share a picture of that unknown alert.

If you delete one alert and later create a new alert with the same name their is no connection between the deleted one and the new created one - only that they belong to the same stream.

The error should resolve if the condition is deleted, that is why I’m asking for the picture. Did you already restarted Graylog in between?

regards
Jan

3

Thanks for your reply.
This is an unknown alert:

image
image.png1331×489 44.1 KB

I didn’t restart the graylog in between. Now I delete this condition again and create another one, it is not yet known if the issue is resolved. I need time to receive this kind of log that can trigger this condition.

Thank you.

6

the alert is resolved and this is shown.

You will always have all alerts that are ever triggered when you click on “show all alerts” - the only way to remove them from the list would be to delete them from the database.

I did not get your problem - to be honest.

Jan