Source tracking
The source tracking function is designed to notify the administrator of Logmanager when an important source of the logs stops logging. This works for any type of log source collected by Logmanager. This function is the initial implementation of monitoring metrics.
Table shows all available information: Name (custom name of the rule), Host (hostname), Period (time of monitoring prior alert dispatch if no logs seen from source), Description (custom description) and Enabled (enabled status).
Source tracking menu
Filter fields are above the table. Data may be filtered by any single column.
If you need to add a new Source tracking rule, click the green plus icon in the main table in the upper right corner.
Enter following data into the prepared form:
- Name: custom name for the rule.
- Hostname: enter hostname.
In the Hostname field, use the value from the meta.src.hostname field of the log source.
- Time period: time, for which no logs received from monitored host will create email alert to Logmanager administrator (destination email address is defined in menu Network / SMTP). Interval from 1 hour to 168 hours can be applied.
- Description: mandatory field to define source tracking rule reason (used in email alert).
- Enabled: enabled status.
Source tracking rules
The table below the Source tracking rule list of monitored hostnames using this rule displays all hosts matching hostname in the time of rule definition. If later there will appear another log source that matches the rule definition, it will be automatically added to monitored sources.
Editing the Source tracking rule can be started by clicking the blue pencil icon, which is shown by the end of the row. Now, the identical form as when adding a new rule is shown.
Deletion of a Source tracking rule is done by clicking the red cross icon, which is shown by end of the row. After clicking the cross a new dialog window Delete a Source tracking rule is opened and the name of the Source tracking rule to be deleted is shown for checking.