Detect log outage for different application running on same server that sending log

Hi @AnLi,

My first idea would be to identify something all the logs from your application have in common (e.g. same event type). Then create a rule that matches against this and uses "Count (Matched Events) = 0" as aggregation. In the rule, you'd then choose a good value for "If this Pattern occurs within any X second time window".

I did not test that, but it would be my first way to try.

Best,

Christian

If your using ClickHouse as the event database, you can use Lookup Tables and Adv SQL Query/Rule to do this.

Lookup Table Definition

Define a Lookup Table exactly as below:

• Name: eventTypeTracker
• Description: Tracks Devices and Critical Event Types and Limits

Table Schema:

Add your entries to the Lookup Table..

ie:

(Enter Limit of zero for a device to track no events at all received.)

Query

Test the Adv SQL query works...   (Last 1 Hour) .. and assumes Enterprise version in use.

WITH     now() AS current_time,     subtractHours(current_time, 1) AS start_time  SELECT     d.reportingIP,     d.eventType,     d.limit,     coalesce(e.received_count, 0) AS received_count FROM fsiem.eventTypeTracker_1 AS d LEFT JOIN (     SELECT         reptDevIpAddrV4 AS reportingIP,         eventType,         count() AS received_count     FROM fsiem.events     WHERE phRecvTime >= start_time AND phRecvTime < current_time     GROUP BY reptDevIpAddrV4, eventType ) AS e ON d.reportingIP = e.reportingIP AND d.eventType = e.eventType WHERE     (d.limit = 0 AND coalesce(e.received_count, 0) = 0)     OR     (d.limit > 0 AND coalesce(e.received_count, 0) < d.limit)

If this meets your objective, I can provide an Adv SQL Rule.