search

cvtienhoven / graylog-plugin-aggregates

Aggregates plugin for Graylog
https://marketplace.graylog.org
GNU General Public License v3.0
53 stars 12 forks source link

Alerts never resolving #24

Closed kiview closed 6 years ago

kiview commented 7 years ago

The alerts under Graylog's alert tab, which are triggered by the plugin, are never resolved (as far as I see), even if the conditions has does not apply anymore.

Running Graylog 2.3

cvtienhoven commented 7 years ago

@kiview I assume you're running the SNAPSHOT version of the plugin. That version isn't a production version, I'm still developing on that functionality (hopefully I manage to fix it). Keep an eye on this space for the final version.

kiview commented 7 years ago

Is this a regression bug in the SNAPSHOT version, or has this not been implemented yet? Do you need support implementing it?

cvtienhoven commented 7 years ago

It's not implemented yet, but I'm busy as we speak, thanks :)

cvtienhoven commented 6 years ago

This should be fixed in version 2.1.0 of the plugin.

tomuk5 commented 6 years ago

This issue is re-occurring with version 2.1.1 of the plugin

cvtienhoven commented 6 years ago

@tomuk5 is this with newly generated alerts? The alerts generated by the SNAPSHOT version didn't have an AlertCondition, and thus could not be resolved. Newly generated alerts should have an alert condition, and should be resolved (with a small delay because of the AlertScanner thread run interval) once the aggregates rule doesn't match. If this doesn't work for you, perhaps you could supply the rule and some debug logging to investigate this issue?

jebucha commented 6 years ago

We upgraded from 2.0.0 to 2.1.1 yesterday morning. I started up my first Graylog node with 2.1.1 around 07:18, then went on to update the other 2 nodes, which were still on 2.0.0. I have 4 pages of unresolved alerts all triggered at the time I brought node1 online with the new plugin. Is there any way to manually resolve or clear those?