Alerts dont work

[HansdeJongh]

Hi,

I have created a queries (which work) and i created an alert (which doesn't work) based on that query.
I dont understand why. Even when i open the alert it will show the results in the "count of events over time", so the query is correct

Dunno what im doing wrong...

help?

Regards

Hans

[sflanders]

Can you attach screenshots of the query and of the alert dialog box?

[admin]

Hello Hans,

You need to adjust your alert thresholds probably, you can do this from the Manage Alerts dialog, select the alert that needs adjustment and click the pencil icon to Edit the Alert. Then adjust the time and the number of matches in the Raise an alert section of the dialog to adjust the threshold. Also make sure your alert is enabled, if not enable it to get it to alert.

Like Steve said a picture of what your edit alert dialog looks like will help in answering you in better way.

Thanks,

-Yogita.

[HansdeJongh]

When i open the query i can see its on "custom time" and not the "last 5 minutes" on which i saved it..

so its on the time that it was when i created the query..

[sflanders]

So you have an alert that runs every 5 minutes. The query on IA returned no results and the alert dialog box query had not finished running. Everything looks good, but the screenshots do not show that you actually have results for the query.

[HansdeJongh]

i tried that too:)

[sflanders]

Cool, so this seems to show that alerts should have been generated. Next, up check the log at /storage/var/loginsight/alerts.log. You should see your alert (by title) in this file -- do you? If yes then this likely indicates that your SMTP settings are incorrect, DNS resolution is not working or you have some network connectivity issue between LI and the SMTP server. The runtime.log should indicate if the problem.

[admin]

Are you getting any system alerts or other alert notifications from loginsight to the email id configured in the Edit alert dialog below? Maybe your smtp settings need modifications to receive emails to that email id?

[HansdeJongh]

yes i test smtp settings as well and they worked...

but ill check the alert log

[HansdeJongh]

the alert log shows some alerts it generated on the 8th of december.(before the upgrade to GA???)

[sflanders · Accepted solution]

Can you restart the master node and then see if alerts work?

[HansdeJongh]

its like win95! the reboot solved it

[sflanders]

It is a bug based on a corner case - lucky you new TP will have the fix, but workaround is restart.