topic Re: OS services monitoring for all services other than X Y Z in Alerting

OS services monitoring for all services other than X Y Z

Yosi_Neuman — Mon, 29 Jul 2024 07:51:08 GMT

Hi guys,

Customer asks to check if all services are in running status except of 3 services.

With in the Detection rules we can set positive $or for more than one service.

But when adding $not in order to negate those services we get syntax error

Also $not to $and is not acceptable and showing syntax error

Any suggestion on how to fulfill this request will be appreciate.

Thanks in advance

Yos

Esam_Eid — Sun, 28 Jul 2024 09:46:22 GMT

it seems the AureAttestService & webClient are two different services, so i believe you have to create two different rules

Yosi_Neuman — Sun, 28 Jul 2024 09:59:59 GMT

Thanks for your suggestion, may be I didn't not explain my self clearly hence I will try again what is our goal here:

We are looking for alert on ALL services beside those 2 services ....

In other words we want to get alert if any service beside those 2 is not in running mode.

Tanks

Yos

Esam_Eid — Sun, 28 Jul 2024 11:19:25 GMT

i just created the below rule to test. the first one should be used if you want to exclude any of the services.

Second one if you want to include everything under monitoring, you just add any prefix which will never match any service name.

after testing i could see the alerts triggered for all stopped services.

Yosi_Neuman — Sun, 28 Jul 2024 11:54:53 GMT

Thanks again @Esam_Eid for your efforts and investigation.

Understood from your answer that we need rule for each negate

Test it also and its look working

Thanks!

Yos