Hi!
I am faced with the following task and do not understand which way to go. I want to create an alert that will be triggered when a certain application is deleted. For example:
index=main source=<custom_source> Message="<program_name> is uninstalled"
Everything works as it should, I use the internal event type and that's not the question. Some software generates 2 events when UPDATING OR UPGRADING, the first: the program is uninstalled and the second: the program is installed. Therefore, in this case, my alert gives a false alarm. I have generated the following alert logic to correct false positives:
Search events for the last 30 Minutes:
index=main source=<custom_source> Message="<program_name> is uninstalled"
Next we need to check whether there were installation events:
index=main source=<custom_source> Message="<program_name> is installed" on the machines from the first request.
And if there was no installation event on the machine after the uninstalled event in the last 30 minutes, then issue an alert.
I cant create a query from this logic. If you could help me with advice, I would be very grateful.
P.S. We looked in the direction of events from the application log and MSI Installer Logs, but in our case this is not applicable and we must use custom source.
Thanks for you help, have a nice day.
... View more
