The syslog-ng Store Box(SSB) appliance can create content-based alerts about log messages based on specific search expressions. Search queries are run every few seconds and an alert is triggered whenever a match between the contents of a log message and a search expression is found. Alerts are collected and sent to a pre-defined email address (or email addresses).
Some log messages might have particular significance and therefore getting notifications about those can often be more efficient than searching for them manually.
You can set up or modify alerts for local logspaces or those logspaces to which you have the relevant privileges, meaning that:
-
Either the relevant user group has been assigned read and write/perform access to the Search > Logs object on the AAA > Access Control page.
-
Or the user group has been added under the Access control option of the relevant logspace on the Log > Logspaces page.
There are two ways to create alerts, using the search interface or the Search > Content-Based Alerts page:
-
For details on how to set up alerts on the search interface, see Setting up alerts on the search interface.
-
For details on how to set up alerts on the Search > Content-Based Alerts page, see Setting up alerts on the Search > Content-Based Alerts page.
NOTE: Content-based alerting is currently not available for filtered, multiple, and remote logspaces.
NOTE: In the case of encrypted logspaces, no decryption key is required for content-based alerting to work. SSB has access to the log messages while processing them, and the indexer and content-based alerting services run before encryption happens.