Highlighted
Absent Member.
Absent Member.
470 views

Stop getting log events from a specific device

Hi All

How are create notification about it when I stop getting log events from a specific device !

example please !

Thanks All

Labels (4)
Tags (3)
0 Likes
Reply
7 Replies
Highlighted
Absent Member.
Absent Member.

What is your time limit here? No packets in an hour? 10 minutes? You can create rules and notification off of those rules. But a single device monitoring and reporting when a single device stops reporting isn't something I've heard of anyone doing (yet). I have seen some monitoring of systems being reachable but not monitoring that logs are being received from specific devices.

0 Likes
Reply
Highlighted
Absent Member.
Absent Member.

You can check out my simple device status monitoring pack

0 Likes
Reply
Highlighted
Absent Member.
Absent Member.

Thanks Benjamin Coll and Mark Jonhston. I new one in the ArcSight user and I need any help with ArcSight.

0 Likes
Reply
Highlighted
Absent Member.
Absent Member.

Dear Mr. Vladimir, first of all your question is not clear to me. If i undestand correctly, i think You want to monitor device status, That means need to monitor which are the devices stop sending events to Manager, Am i right? Regards Renji

0 Likes
Reply
Highlighted
Absent Member.
Absent Member.

Thanks for answer James
yes you are right. Do you have any example ?

Regards Vladimir

0 Likes
Reply
Highlighted
Absent Member.
Absent Member.

Hi, I checked and it can be doable by agent vise. Let me check on more on this. In this mean time you can do it by monitoring each devices. In our environment, we have a dashboard to monitor all critical devices. From that its possible to monitor primary, secondary device handover. If any dashboard is empty, its means these devices are not sending logs to ESM, however you only need to monitor the critical devices. create a list of all critical devices and create a dash board.

0 Likes
Reply
Highlighted
Absent Member.
Absent Member.

Hi Vladimir,

Please check my post regarding same question. All the R&D has been explored by experts here in this post.

I am successfully using this.

Regards,

Amit

0 Likes
Reply
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.