Event sources availability monitoring

[RSAAdmin]

Hello, guys,

There is a nice feature in envision to generate an message when the event source stops generating logs. There is a default message 508100 and a custom message 40029. You can setup that 40029 message with a special config: for example for one event source type to generate this message if no events come within 1 hour and for another device group to generate if no events come within 24 hours.

This is really good to monitor device availability.

I wonder is there anything like that in SA?

As I get it in 10.3 rsa put all the alerting/correlation in the paid ESA module - so I see no way of doing it automatically right now.

PS. You can find more info in the attached old-school 4.0 SP3 envision release notes.

[Anonymous]

Ahh good point, thanks! I'll give that a shot

[RSAAdmin]

Does anyone know what message appears and where when a log decoder receives a message from new event source? Is it the same message if it's a multi-device (two event sources on one ip)?

It's good for new devices availability monitoring (especially syslog).

[huanzhou1]

you can put different device types with same IP address.

For example this server:192.168.0.1 linux with apache, you can do like this:

apache 192.168.0.1  10mins

rhlinx 192.168.0.1  10mins

[RSAAdmin]

Do you have information if wildcards or regex is supported for Event Source Monitoring?

For example:

winevent_nic * 1 hour - to monitor all windows servers

* 192\.168.* 30 mins - to monitor all dmz devices

[RSAAdmin]

Is there anyway to remove previous VLC logdecoders from the event source monitoring?

I'm getting lots of false positives from event sources that have moved to new VLC collectors.

[Anonymous]

You probably need to clear out the logStats to do this, but I would check with RSA support before doing this - there's no way to selectively remove old devices AFAIK.

[Anonymous]

I can see the Event Source Monitoring in the SA console but do you know how to get report for Event Source availability?.I'm looking for a solution in V10.4. Thanks!!