Alerts can be built based [[:en:documentation:pandorafms:monitoring:09_log_monitoring|on the received logs]]. These alerts can be simple or complex, based on a set of rules with logical relationships.
This type of alerts allows working from a much more flexible perspective, since alerts are not generated based on the status of a specific Module, but on a log that may have been generated by several different Modules and even from different Agents.
Each log alert is configured to trigger on a certain type of event; when the logical equation defined by the rules and their operators is met, the alert will be triggered.
Given the high number of logs that can be stored in Pandora FMS, the server works on a maximum event window, parameter [[:en:documentation:pandorafms:installation:04_configuration#log_window|log_window]], which is defined in the configuration file ''pandora_server.conf''. The logs that have been generated out of this time window will not be processed by the server.
For the log alerts to work, the [[:en:documentation:pandorafms:installation:04_configuration#logserver|logserver]] should be activated with the ''logserver 1'' parameter in the Pandora FMS server configuration file.
With the <wrap :en>**Create**</wrap> button a new log alert is added and the process is similar to the creation of a [[#ks4|alert template]]. There are five steps for the complete creation of a log alert, some important aspects are:
* Step 1, <wrap :en>**Configure**</wrap>: It contains the basic data such as the group of agents to which the log alert will belong, name of the alert and its severity.
+
* Step 2, <wrap :en>**Conditions**</wrap>: Step where a [[#ks4|alert template]], some [[[:en:documentation:pandorafms:technical_annexes:26_pfms_list_of_special_days|list of special days]], the <wrap :en>**Disable event**</wrap> option (the event generated in the alert trigger event view will not be created if this token is checked) and a rule evaluation mode will be assigned:
When there are two or more log alerts, they are evaluated one by one following the chronological order of creation and, if necessary, establishing a hierarchy.
Each log alert has two specific configuration parameters for this purpose:
+
+
各ログアラートには、この目的のための 2 つの特定の構成パラメータがあります。
+
+
* <wrap :en>**Rule evaluation mode**</wrap>: Choosing <wrap :en>**Pass**</wrap> means that, in case a log meets the [[#ks13_2|rules of an alert]], all other log alerts are still evaluated below. **This is the default behavior**. In the case of choosing <wrap :en>**Drop**</wrap>, when a log meets an alert **all other log alerts will no longer be evaluated**.
+
* <wrap :en>**Grouped by**</wrap>: Allows grouping the [[#ks13_2|rules]] by Agent, Group, Module or Module Alert. Thus, if a rule is configured to be triggered when two critical events are received **and grouped by Agent**, two critical events should arrive from the same Agent.
For alerts containing //logs// rules, only the grouping by Agent will be affected. If you choose a different grouping, **alerts based on** //logs// **will never be fulfilled**.
When you finish the creation and return to the global view you will have the list of registered log alerts and information about them, as well as options about them (operate with the action disabled, in <wrap :en>**standby**</wrap> mode, add more actions, edit or delete the corresponding log alert). **It is also possible to change the order of the different log alerts**.
Event alerts are based on filtering rules using the following logical operators:
+
+
ログアラートは、次の論理演算子を使用したフィルタリングルールに基づいています。
+
+
* ''and''
+
* ''nand''
+
* ''or''
+
* ''nor''
+
* ''xor''
+
* ''nxor''
+
+
These logical operators are used to search for logs and/or expressions that match the configured filtering rules and if matches are found the alert will be triggered.
To define the rules of the alert, it will be necessary to drag the elements on the left side to the <wrap en:>**drop area**</wrap> on the right side to build your rule.
These elements will be enabled to guide the user in complying with the grammar of the rule. The following is a simplified explanation of the grammar to be used:
The blocks have simultaneity in fulfilling the condition:
+
+
</WRAP>
+
+
<WRAP center round tip 90%>
+
+
ブロックは条件を満たす点で同時性を持っています:
+
+
</WRAP>
+
+
<WRAP center round box 30%>
+
+
(A and B)
+
+
</WRAP>
+
+
It forces the analyzed element (log) to fulfill simultaneously A and B.
+
+
分析された要素 (イベント) が A と B に同時に準拠するように強制します。
+
+
<WRAP center round box 30%>
+
+
A and B
+
+
</WRAP>
+
+
It forces both rules (A) and (B) to be satisfied in the evaluation window. This means that there must be entries satisfying both rules in the last seconds (defined by the ''log_window'' parameter).
In the comparison operators ''=='' and ''!=''' the text strings are compared literally. For more flexibility consider using the ''REGEX'' operator which uses Regular Expressions.
''Field2'' , ''Field3'', (...) , ''Field//n//'' must be configured, which are used to transfer the information from //template// to //action// and from action to //command//, to finally be used as parameters in the execution of that command.
This information is transferred as long as the next step does not already have information defined in its ''Field**n**'' fields. That is, in case of overlapping fields or parameters, it overwrites the action to the template (for example, if the template has ''Field1'' defined and **the action also**, the ''Field1'' of the action //overwrites// the action of the template).
**Version 764 or later**: Macros related to modules and agents are not available in the fields of the <wrap :en>**Alert recovery**</wrap> section since the recovery of these alerts is executed when the <wrap :en>**threshold**</wrap> ends and lacks a **recovery event** to obtain such information.
In this section you must configure the actions to be performed when the log alert is triggered and indicate at what intervals and how often this action will be executed.
Once you have selected the above parameters, press the <wrap :en>**Add**</wrap> button and then you can choose and view the list of configured actions (section <wrap :en>**Select the desired action and mode to view the Triggering fields for this action**</wrap>).
The macros that can be used within the configuration of an event alert are in the [[#ks15|list of macros]].
+
+
ログアラートの設定内で使用できるマクロは、[[#ks15|マクロ一覧]]にあります。
+
+
<wrap #ks14 />
+
+
===== SIEM アラート =====
+
+
These alerts are evaluated by the SIEM event server at the time of their generation, so for their correct operation, the [[:en:documentation:pandorafms:monitoring:21_siem|SIEM monitoring]] must be enabled and configured.
In this section it is possible to create, edit and delete SIEM alerts. The [[:en:documentation:pandorafms:management_and_operation:11_managing_and_administration#ks1_3_1|LW permission]] is required to access this section.
These alerts are based on the filter system of the SIEM event views, so that any event that was displayed with the configured filter conditions will trigger the alert.
For example, if a SIEM alert is configured with a critical event filter, just before the SIEM event server generates one with that condition the alert will be triggered.
In this section it is possible to view, enable/disable and change the standby mode of the SIEM alerts available in the environment. The [[:en:documentation:pandorafms:management_and_operation:11_managing_and_administration#ks1_3_1|LM permission]] is required to access this section.