Discussion:
Streams alerting for no messages
Kris Johnson
2014-02-26 09:48:00 UTC
Permalink
Hi ,

We keep getting alerts firing even when messages have been stored for that
stream in the period selected..

I am looking into timings but a lot seem to be when its doing the
following..

2014-02-26T09:19:30.511Z3d329d24-275d-4425-96e5-c254d750682b<http://graylog.crispthinking.com:9000/system/nodes/3d329d24-275d-4425-96e5-c254d750682b>Optimizing
index <graylog2_1217>.2014-02-26T09:19:30.511Z
3d329d24-275d-4425-96e5-c254d750682b<http://graylog.crispthinking.com:9000/system/nodes/3d329d24-275d-4425-96e5-c254d750682b>Cycled
deflector from <graylog2_1217> to <graylog2_1218>2014-02-26T09:19:30.255Z
3d329d24-275d-4425-96e5-c254d750682b<http://graylog.crispthinking.com:9000/system/nodes/3d329d24-275d-4425-96e5-c254d750682b>Re-calculating
index ranges.

Stream had 0 messages in the last 30 minutes with trigger condition less
than 1 messages. (Current grace time: 0 minutes)



##########

Date: 2014-02-26T09:19:58.982Z

Stream ID: 52f10fea0cf22b2257f269e9

Stream title: FeedReader Messages Sent

Stream rules: [StreamRuleImpl: <{_id=52f111150cf22b2257f269fb,
field=message, value=Msg_Sent, stream_id=52f10fea0cf22b2257f269e9,
inverted=false, type=2}>, StreamRuleImpl: <{_id=52fb66620cf211b93e1fd5c1,
field=message, value=CRSP-FR-03, stream_id=52f10fea0cf22b2257f269e9,
inverted=false, type=2}>] Alert triggered at: 2014-02-26T09:19:58.956Z
Triggered condition:
3170df79-5985-45c0-a0d6-a724748ed76a:MESSAGE_COUNT={time: 30,
threshold_type: less, threshold: 1, grace: 0},
stream:={52f10fea0cf22b2257f269e9: "FeedReader Messages Sent"} ##########


Yet here are a few time's of message's from that stream...

2014-02-26 09:14:19.194 FeedReader.exe:

2014-02-26 09:01:07.904 FeedReader.exe

2014-02-26 09:00:20.720 FeedReader.exe:
--
You received this message because you are subscribed to the Google Groups "graylog2" group.
To unsubscribe from this group and stop receiving emails from it, send an email to graylog2+unsubscribe-/JYPxA39Uh5TLH3MbocFF+G/***@public.gmane.org
For more options, visit https://groups.google.com/groups/opt_out.
Kris Johnson
2014-02-26 14:44:20 UTC
Permalink
Post by Kris Johnson
Hi ,
We keep getting alerts firing even when messages have been stored for that
stream in the period selected..
I am looking into timings but a lot seem to be when its doing the
following..
2014-02-26T09:19:30.511Z3d329d24-275d-4425-96e5-c254d750682b<http://graylog.crispthinking.com:9000/system/nodes/3d329d24-275d-4425-96e5-c254d750682b>Optimizing
index <graylog2_1217>.2014-02-26T09:19:30.511Z
3d329d24-275d-4425-96e5-c254d750682b<http://graylog.crispthinking.com:9000/system/nodes/3d329d24-275d-4425-96e5-c254d750682b>Cycled
deflector from <graylog2_1217> to <graylog2_1218>2014-02-26T09:19:30.255Z
3d329d24-275d-4425-96e5-c254d750682b<http://graylog.crispthinking.com:9000/system/nodes/3d329d24-275d-4425-96e5-c254d750682b>Re-calculating
index ranges.
Stream had 0 messages in the last 30 minutes with trigger condition less
than 1 messages. (Current grace time: 0 minutes)
##########
Date: 2014-02-26T09:19:58.982Z
Stream ID: 52f10fea0cf22b2257f269e9
Stream title: FeedReader Messages Sent
Stream rules: [StreamRuleImpl: <{_id=52f111150cf22b2257f269fb,
field=message, value=Msg_Sent, stream_id=52f10fea0cf22b2257f269e9,
inverted=false, type=2}>, StreamRuleImpl: <{_id=52fb66620cf211b93e1fd5c1,
field=message, value=CRSP-FR-03, stream_id=52f10fea0cf22b2257f269e9,
inverted=false, type=2}>] Alert triggered at: 2014-02-26T09:19:58.956Z
3170df79-5985-45c0-a0d6-a724748ed76a:MESSAGE_COUNT={time: 30,
threshold_type: less, threshold: 1, grace: 0},
stream:={52f10fea0cf22b2257f269e9: "FeedReader Messages Sent"} ##########
Yet here are a few time's of message's from that stream...
2014-02-26 09:01:07.904 FeedReader.exe
running on version 0.20.1
--
You received this message because you are subscribed to the Google Groups "graylog2" group.
To unsubscribe from this group and stop receiving emails from it, send an email to graylog2+unsubscribe-/JYPxA39Uh5TLH3MbocFF+G/***@public.gmane.org
For more options, visit https://groups.google.com/groups/opt_out.
Kris Johnson
2014-02-26 14:45:13 UTC
Permalink
Kris Johnson
2014-02-27 09:54:12 UTC
Permalink
well another night and 4 more times this emailed ... all 4 occasions it
had started to reindex
2014-02-27T08:48:29.222Z3d329d24-275d-4425-96e5-c254d750682b<http://graylog.crispthinking.com:9000/system/nodes/3d329d24-275d-4425-96e5-c254d750682b>Re-calculating
index ranges.


Stream had 0 messages in the last 30 minutes with trigger condition less
than 1 messages. (Current grace time: 0 minutes)



##########

Date: 2014-02-27T08:48:58.993Z

Stream ID: 52f10fea0cf22b2257f269e9

Stream title: FeedReader Messages Sent

Stream rules: [StreamRuleImpl: <{_id=52f111150cf22b2257f269fb,
field=message, value=Msg_Sent, stream_id=52f10fea0cf22b2257f269e9,
inverted=false, type=2}>, StreamRuleImpl: <{_id=52fb66620cf211b93e1fd5c1,
field=message, value=CRSP-FR-03, stream_id=52f10fea0cf22b2257f269e9,
inverted=false, type=2}>] Alert triggered at: 2014-02-27T08:48:58.930Z
Triggered condition:
3170df79-5985-45c0-a0d6-a724748ed76a:MESSAGE_COUNT={time: 30,
threshold_type: less, threshold: 1, grace: 0},
stream:={52f10fea0cf22b2257f269e9: "FeedReader Messages Sent"} ##########


any ideas?
--
You received this message because you are subscribed to the Google Groups "graylog2" group.
To unsubscribe from this group and stop receiving emails from it, send an email to graylog2+unsubscribe-/JYPxA39Uh5TLH3MbocFF+G/***@public.gmane.org
For more options, visit https://groups.google.com/groups/opt_out.
Robert Blumen
2014-08-11 16:06:38 UTC
Permalink
We are seeing a lot of this and in 100% of cases it corresponds to graylog
rolling the indexes or doing some kind of a rebuild on the indexes.
Post by Kris Johnson
Hi ,
We keep getting alerts firing even when messages have been stored for that
stream in the period selected..
I am looking into timings but a lot seem to be when its doing the
following..
2014-02-26T09:19:30.511Z3d329d24-275d-4425-96e5-c254d750682b
<http://graylog.crispthinking.com:9000/system/nodes/3d329d24-275d-4425-96e5-c254d750682b>Optimizing
index <graylog2_1217>.2014-02-26T09:19:30.511Z
3d329d24-275d-4425-96e5-c254d750682b
<http://graylog.crispthinking.com:9000/system/nodes/3d329d24-275d-4425-96e5-c254d750682b>Cycled
deflector from <graylog2_1217> to <graylog2_1218>2014-02-26T09:19:30.255Z
3d329d24-275d-4425-96e5-c254d750682b
<http://graylog.crispthinking.com:9000/system/nodes/3d329d24-275d-4425-96e5-c254d750682b>Re-calculating
index ranges.
Stream had 0 messages in the last 30 minutes with trigger condition less
than 1 messages. (Current grace time: 0 minutes)
##########
Date: 2014-02-26T09:19:58.982Z
Stream ID: 52f10fea0cf22b2257f269e9
Stream title: FeedReader Messages Sent
Stream rules: [StreamRuleImpl: <{_id=52f111150cf22b2257f269fb,
field=message, value=Msg_Sent, stream_id=52f10fea0cf22b2257f269e9,
inverted=false, type=2}>, StreamRuleImpl: <{_id=52fb66620cf211b93e1fd5c1,
field=message, value=CRSP-FR-03, stream_id=52f10fea0cf22b2257f269e9,
inverted=false, type=2}>] Alert triggered at: 2014-02-26T09:19:58.956Z
3170df79-5985-45c0-a0d6-a724748ed76a:MESSAGE_COUNT={time: 30,
threshold_type: less, threshold: 1, grace: 0},
stream:={52f10fea0cf22b2257f269e9: "FeedReader Messages Sent"} ##########
Yet here are a few time's of message's from that stream...
2014-02-26 09:01:07.904 FeedReader.exe
--
You received this message because you are subscribed to the Google Groups "graylog2" group.
To unsubscribe from this group and stop receiving emails from it, send an email to graylog2+unsubscribe-/JYPxA39Uh5TLH3MbocFF+G/***@public.gmane.org
For more options, visit https://groups.google.com/d/optout.
Continue reading on narkive:
Loading...