Event sources availability monitoring

[RSAAdmin]

Hello, guys,

There is a nice feature in envision to generate an message when the event source stops generating logs. There is a default message 508100 and a custom message 40029. You can setup that 40029 message with a special config: for example for one event source type to generate this message if no events come within 1 hour and for another device group to generate if no events come within 24 hours.

This is really good to monitor device availability.

I wonder is there anything like that in SA?

As I get it in 10.3 rsa put all the alerting/correlation in the paid ESA module - so I see no way of doing it automatically right now.

PS. You can find more info in the attached old-school 4.0 SP3 envision release notes.

[huanzhou1 · Accepted solution]

go to Administration - System , event source monitoring, you can monitor the event sources accordingly, is this the function you need?

[RSAAdmin]

Thanks! Will try, didn't notice there was such an easy way, hope it works

[huanzhou1]

i found out when i was doing some project, the customer also requested the same. you can view the event sources status under log decoder status, then monitor accordingly, can send out email if you want.

[Anonymous]

Hi Patriot,

where we can see the device status? can you please tell us the path

like administration>Device>select decoder>

or if event source stop sending logs then can send out mail for that we have to configure email in system>email tab.

is that right ? or have any other way to configure email notification for event source monitoring?

[Anonymous]

So this seems to work if we reboot the box but say if the log decoder stops capturing but all other services are working we dont get notified. We loaded the RSA custom parser to parse its own messages and are going to attempt a ESA alert for this. If anyone has a better solution let me know.

See :

[huanzhou1]

Devices -  select log decoder - stats , under Log Stats you can find all the event sources.

[huanzhou1]

I think the function was monitored by jettysrv, i believe you can use snmp to monitor the processes.

[Anonymous]

I didnt event think about SNMP but maybe. Is there a mib? My issue is even if the service is running capture or consuming may be paused. Not sure how to monitor/alert on that just yet. If I get ESA working i'll post something on it.

[huanzhou1]

it's default MIBs, check the /etc/snmp/snmpd.conf.

I used the syslog for the event source monitoring so i create an app rule for it to alert. Or you can use email.