Alert Notifiation for Logger threshold
I wanted to write a query on logger to send a alert notification if the storage usage goes beyond 90%.
please assist me on this.
You can key off of the Loggers internal events to accomplish this. Look for deviceEventClassId = storagegroup:100
This event has the "% of space used" in the field deviceCustomNumber1. It's just a number, but it represents the % full, the value fname in the CEF event has the name of the storage group. There will be one event for each storage group on the logger.
You should be able to create a filter from these events to accomplish what you want.
Are you on appliance or software logger ?
Those events exist on the appliance logger (CEF:0\|ArcSight\|Logger\|\S+\|storagegroup:100), I'm not sure if they are not included on the software version ?