search

opencrvs / opencrvs-core

A global solution to civil registration
https://www.opencrvs.org
Other
85 stars 68 forks source link

SSH Login Alert not firing in Kibana #6515

Open euanmillar opened 7 months ago

euanmillar commented 7 months ago

I set up new servers with 1.4.0 infrastructure and the Kibana alert rules are all loaded.

Low disk space errors successfully fire and I receive an alert email.

Image

The Query in the rule returns no documents despite me being SSH'ed into the server.

Expected behaviour

When I SSH into the server I expect to get an SSH access alert email, however no email arrives.

euanmillar commented 3 months ago

Based on IPP feedback, none of the alerts are firing for those implementers: https://opencrvsworkspace.slack.com/archives/C06758YF5TJ/p1717134574211229?thread_ts=1716998390.205639&cid=C06758YF5TJ

rikukissa commented 3 months ago

@euanmillar that specific error was because the host machine had Elasticsearch running on it before OpenCRVS was installed causing a conflict

There were multiple elasticsearch instances running. Stopped them and scaled the instance back up. Also had to manually create the alert rule in kibana.

@ak-shanith