New Ranks & Badges For The Community!
Notice something different? The ranks and associated badges have gone "Star Fleet". See what they all mean HERE
Highlighted
Captain
Captain
210 views

Alert Notifiation for Logger threshold

Hello,

I wanted to write a query on logger to send a alert notification if the storage usage goes beyond 90%.

please assist me on this.

Regards,

Suresh

Labels (1)
0 Likes
3 Replies
Highlighted
Absent Member.. Absent Member..
Absent Member..

You can key off of the Loggers internal events to accomplish this.  Look for deviceEventClassId = storagegroup:100

This event has the "% of space used"  in the field deviceCustomNumber1. It's just a number, but it represents the % full, the value fname in the CEF event has the name of the storage group. There will be one event for each storage group on the logger.

You should be able to create a filter from these events to accomplish what you want.

HTH,

Dean

0 Likes
Highlighted
Captain
Captain

Hello farridem,

I am not able to view "storagegroup:100" event under mentioned ArcSight Fields, is there any other way to check the same?

Regards,

Suresh

0 Likes
Highlighted
Absent Member.. Absent Member..
Absent Member..

Are you on appliance or software logger ?

Those events exist on the appliance logger (CEF:0\|ArcSight\|Logger\|\S+\|storagegroup:100), I'm not sure if they are not included on the software version ?

Dean

0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.