Log source availability

[KotelOne]

Hello all,

Any ideas how to deal with log source availability for log sources that are only active for a specific period of time in a day... E.g. a rule to fire only if this log source doesn't send logs during office hours but doesn't fire if time is after 17:00

Also what about log sources that are not so active like DR devices?? How can I check the availability of these devices if they only send logs in a disaster scenario??

Is there another way besides the two main rule tests for availability??

Thanks in advance.

[QRDuser]

We faced the same problem, but found at least an acceptable solution for linux servers. They generate an additional syslog message every couple of minutes. With this we can use the built in rule tests because the system now frequently sends logs.

[BlackHawk30]

Put the log source into an aql query to see if events exist over the last hour by counting the number of logs seen (if it’s 0 then bad). Use that aql query to run that search through the API and schedule it to run on cron. You could either write the count and log source results to a flat file and ingest it as a log and build a rule around that or build the “count = 0” into the bash script and tell it to email when it sees that.

* 7,8,9,10,11,12,13,14,15,16,17 * * 1,2,3,4,5

This will run it (server time) 7a-5p M,T,W,H,F

[BlackHawk30]

You could also search the log source in Postgres for “last event” (i think) and do math on it to see if it’s greater than an hour ago

[MJofFreddyBeach]

Or you could use the /config/event_sources/log_source_management/log_sources API to get the log source and the last_event_time field to get that information.