Disconnected cfapi vRLI Agent alerts?

[carvaled]

So I have these cfapi vRLI agents which are randomly disconnecting from vRLI and I need to generate an alert when they end up in a state of "disconnected"...

I was thinking this would be a straight forward and simple thing to do but I for the life of me cant find a way to do it!

does anyone have a solution?

Cheers

vMAN

[daphnissov · Accepted solution]

While probably not *exactly* what you're looking for (there's no good way at this time), I did work around this problem with a solution I detail in my article here. Maybe this helps in some way.

[SIsraelyan]

Hi,

Log Insight has a new "Dormant Hosts" feature which triggers an alert when events stop coming in from a given host for a specified amont of time.

Which LI version are you using ?

[daphnissov]

Could you tell us more information about this? I am not aware of it and would like to know more. The documentation doesn't have any information that I can find on a search.

[SIsraelyan]

I'll get back to you early next week with the details!

Sincerely, Sam!

[carvaled]

Thanks yeah I implemented the same thing but with 100's of agents this is becoming a nightmare to manage.

I was hoping it had something out of the box as it shows up in the GUI... (I am surprised they don't to be honest!!)

Cheers

vMan

[carvaled]

very interesting... can you please provide more information?

what would be nice is like a checkbox next to each agent which I can select that says "Alert on Disconnections" for example... the vRLI engineers / developers need to work this out for Enterprise customers at scale.

[SIsraelyan]

Hi,

LI has a new feature called Dormant Hosts which is currently being tested and will become available in 4.6GA release.

This feature monitors agents and hosts that send data to LI and alerts when it detects an agent(s)/host(s) NOT sending data to LI for some reason for the given/specified period of time.

[daphnissov]

Can't wait for 4.6 in that case.

[carvaled]

cool cant wait to see it.