Is it possible to trigger a restart script on forwarder when an alert condition is met?

[krishnacasso]

Hi,

We monitor server status using access live log. It will continuously check for 200 statuses from the log. When we have status other than 200, for 5 minutes we need to trigger an alert. I see a option in +add action to run a script. Can we place a restart script on the server where the forwarder is installed and trigger it whenever the alert condition in triggered?

Thanks.

[Masa]

There is such built-in feature to access forwarder from a search head where you trigger a post script. So, you have to create your own scripts to make it work like that.

[krishnacasso]

Thanks Masa,
Do we need to manually access the forwarder from UI or Is there a way to automate this.

Thanks.

[Masa]

It depends. Your system admin should be able to advise how to remotely run command or access to remote server by script.