topic Re: Phone Home Error Not Alerting Properly in Alerting

Phone Home Error Not Alerting Properly

drizzo — Mon, 31 Jul 2017 13:54:37 GMT

So, I have my Phone Home Error search; when I type it into the Search Bar, it pulls up all hosts not connected. However, when I try to set it up as an alert, it will only send out an Alert for the first one that disconnected. I have it Throttled, but for suppressing those with the same host.

Also, over time, it will stop pulling computers that have been disconnected from the server for more than 7 days. The only way to get them is to do an All Time search (using the search string from the alert).

I'm a little lost, and would be thankful for any guidance. Thanks.

My Search:

| metadata type=hosts index=_internal | eval age=now()-recentTime | where age > 300 | eval "Time Indexed"=strftime(_time, "%Y/%d/%m %H:%M") | eval "Computer Host"=host | eval "Time Last Connected"=tostring(age, "duration") | eval "Date Last Connected"=strftime=)recentTime, ""%+") | table "Computer Host", "Time Last Connected", "Date Last Connected"

My Alert Settings:

Re: Phone Home Error Not Alerting Properly

sbbadri — Tue, 29 Sep 2020 15:09:56 GMT

Try to change query like below,

Re: Phone Home Error Not Alerting Properly

woodcock — Mon, 31 Jul 2017 14:27:58 GMT

Generally, when using the metadata command for something like this, you should be using All time for your search span. The way that metadata works is to go to buckets written within your span and give you a summary of that If you limit your search's time to a window that does not include any buckets, then you will get no summary, which is NOT what you need. So set it to All time (or a REALLY long time) and do not at all be concerned that you are doing a deep/expensive search, because for this particular command, you definitely are not because like tstats, it is operating on the metadata.

Re: Phone Home Error Not Alerting Properly

drizzo — Mon, 31 Jul 2017 14:54:03 GMT

I suppose I misunderstood what metadata is used for. Thanks.