Alert for last received event

[GKleinow]

I want to create an alert to let me know when the last received event from a host exceeds 24 hours. I can see this information under the Administration -> Management -> Hosts view, but I would prefer that an email alert be sent. Any help would be greatly appreciated, thanks.

[daphnissov]

I wrote a blog post about this problem which you should be able to use to adjust the time window to what you want. I also understand from a VMware employee on this forum that an alarm for when a host stops logging will be built into 4.6.

[GKleinow]

If I am reading your document correctly it allows me to see when a server has sent the last event. I need to have a list of hosts that have not communicated with the Log Insight server in the last 24 hours.

[daphnissov]

I'm not entirely sure I understand your question. You need the vRLI agent installed, and through the query described in my article it detects when it has not seen N number of messages. Therefore you need to have hosts that are reporting to vRLI and define which ones in the alert.