Introduction
This article provides an overview of Logsign system notifications and error messages.
System Notifications
Logsign has services for health checks, and when a critical situation is detected by these services, Logsign health check logs are created. These logs have DataType system and Event.Type Health Check. You can review these logs in detail from the table below.
| Event.Category | Event.VendorID | Event.Status | Event.Action | Event.Note |
| EPS | 100101 | green | status ok |
"Check EPS Average" defined in log sources EPS Average Checked. It reports that there is no problem in EPS Status. |
| EPS | 100102 | yellow | increase |
"Check EPS Average" defined in log sources Reports an increase in EPS Average. For the example above, the notification log will appear as follows. General EPS average increase more than % 30 in 5 minutes. Last average is 12. Current EPS is 20. The check compares the average EPS of the last 5 minutes with the average of the previous 5 minutes. The default threshold is 30% for both increase and decrease. For a log source, the thresholds can be changed in the source's Check EPS Average settings. |
| EPS | 100103 | yellow | decrease |
"Check EPS Average" defined in log sources It informs us that there is a decrease in EPS Average. For the example above, the notification log will appear as follows. General EPS average decrease more than % 30 in 5 minutes. Last average is 12. Current EPS is 5. |
| Disk State | 100201 | green | size ok | There is no problem with disk usage. The log also carries the available disk size information. |
| Disk State | 100203 | yellow | disk usage alert | Disk usage has exceeded the warning limit. Logging continues, but disk space should be checked before the usage limit (100202) is reached. |
| Disk State | 100202 | red | limit exceed |
The disk space usage limit is exceeded. Exceeding this limit causes logging to stop. |
| Integration | 100301 | green | start |
Logs are successfully received from the source. |
| Integration | 100302 | red | stop |
No logs are received from the source during the Health Check period. |
| Syslog Service | 100401 | green | status ok | There is no problem in the syslog service. Logs are being received with the syslog protocol. |
| Syslog Service | 100402 | red | collection error | No logs are received from syslog sources within 5 minutes. |
| Index | 100501 | green | start | The Index (Elasticsearch) service is running and the cluster status is green. |
| Index | 100501 | yellow | start | The Index (Elasticsearch) service is running, but the cluster status is yellow, today's index is found while the cluster is not green, or an error was found in the Elasticsearch log file. This state uses the same VendorID and Event.Action as the green state; only Event.Status is yellow. |
| Index | 100502 | red | stop | The Index (Elasticsearch) service is stopped. |
| Persist | 100601 | green | status ok | The Persist service is writing logs to disk. |
| Persist | 100602 | red | stop | The size of the logs written by the Persist service has not changed within the check period (5 minutes by default). |
| Archived Data | 100701 | green | status ok | There is no problem with the archive files, folder and file sizes. |
| Archived Data | 100706 | yellow | size error | The archive files of the previous day are smaller than expected. |
| Archived Data | 100707 | red | file error | The archive files of the previous day are not found or cannot be read. |
| Archived Data | 100702 | red | folder error | The archive folder of the previous day (/opt/var/log/archive/YYYY/MM/DD) is not found. |
| Signed Data | 100703 | green | status ok | There is no problem with the signed files, folder and file sizes. |
| Signed Data | 100704 | yellow | size error | The signed files of the previous day are smaller than expected. |
| Signed Data | 100708 | red | file error | The signed files of the previous day are not found or cannot be read. |
| Signed Data | 100705 | red | folder error | The signed folder of the previous day (/opt/var/log/signed/YYYY/MM/DD) is not found. |
| Stored Data | 100801 | yellow | file create | A new file is created in the archive or signed directory. |
| Stored Data | 100802 | red | file modify | An archive or signed file is updated. |
| Stored Data | 100803 | yellow | file move | An archive or signed file is moved. |
| Stored Data | 100804 | red | file delete | An archive or signed file is deleted. |
| Stored Data | 100901 | yellow | folder create | A new folder is created in the archive or signed directory. |
| Stored Data | 100902 | yellow | folder move | A folder is moved in the archive or signed directory. |
| Stored Data | 100903 | red | folder delete | A folder is deleted in the archive or signed directory. |
For the logs in the table above, Logsign provides predefined alarms in its library. These alarms are disabled by default. You can review and enable them on the Settings > Alerts & Incidents > Alert Rules page.
The conditions that trigger these alarms are described below.
| Health Check EPS Average Increased | Triggered by the EPS increase log (100102). |
| Health Check EPS Average Decreased | Triggered by the EPS decrease log (100103). |
| Health Check Disk Usage Warning | Triggered when disk usage exceeds the warning limit (100203). |
| Health Check Logging Stopped Caused by Disk Size Limitation | Triggered when the disk space usage limit is exceeded and logging stops (100202). |
| Health Check Log Collection Error | Triggered if no logs are received from a log source during the Health Check period (100302). |
| Health Check Syslog Service Stopped | Triggered if no logs are received from syslog sources within 5 minutes (100402). |
| Health Check Index Service Stopped | Triggered when the Index (Elasticsearch) service is stopped (100502). |
| Health Check Persist File has not been Changed | Triggered when the Persist service does not write any logs within the check period (100602). |
| Health Check Archive Folder Does Not Exist | Triggered when the archive folder of the previous day is not found (100702). |
| Health Check Signed Files have Small Size | Triggered when the signed files are smaller than expected (100704). |
| Health Check Signed Folder Does Not Exist | Triggered when the signed folder of the previous day is not found (100705). |
| Health Check File Create on Stored Data Path | Triggered when a user other than logsign creates a file in the archive or signed directory (100801). |
| Health Check File Modify on Stored Data Path | Triggered when a user other than logsign updates an archive or signed file (100802). |
| Health Check File Movement on Stored Data Path | Triggered when a user other than logsign moves an archive or signed file (100803). |
| Health Check File Delete on Stored Data Path | Triggered when a user other than logsign deletes an archive or signed file (100804). |
| Health Check Folder Create on Stored Data Path | Triggered when a user other than logsign creates a folder in the archive or signed directory (100901). |
| Health Check Folder Movement on Stored Data Path | Triggered when a user other than logsign moves a folder in the archive or signed directory (100902). |
| Health Check Folder Delete on Stored Data Path | Triggered when a user other than logsign deletes a folder in the archive or signed directory (100903). |
You can follow the steps below to turn on the alarm notification.
Alarm Notification
Turn on alarm notifications by creating an action rule on the Settings > Alerts & Incidents > Action Rules page.
Complete the process with the Save button.