OS services monitoring for all services other than X Y Z

Platform Alerting
,
1

Hi guys,

Customer asks to check if all services are in running status except of 3 services.

With in the Detection rules we can set positive $or for more than one service.

Yosi_Neuman_1-1722154754225.png

But when adding $not in order to negate those services we get syntax error

Yosi_Neuman_0-1722154731178.png
Yosi_Neuman_0-1722154731178.png632×134 2.81 KB

Also $not to $and is not acceptable and showing syntax error

Yosi_Neuman_3-1722154912757.png
Yosi_Neuman_3-1722154912757.png609×118 2.88 KB

Any suggestion on how to fulfill this request will be appreciate.

Thanks in advance

Yos

2

it seems the AureAttestService & webClient are two different services, so i believe you have to create two different rules

3

Hi @Esam_Eid

Thanks for your suggestion, may be I didn’t not explain my self clearly hence I will try again what is our goal here:

We are looking for alert on ALL services beside those 2 services …

In other words we want to get alert if any service beside those 2 is not in running mode.

Tanks

Yos

4

Hi @Yosi_Neuman ,

i just created the below rule to test. the first one should be used if you want to exclude any of the services.

Second one if you want to include everything under monitoring, you just add any prefix which will never match any service name.

after testing i could see the alerts triggered for all stopped services.

Esam_Eid_0-1722165424184.png
Esam_Eid_0-1722165424184.png1432×595 17.4 KB

5

Thanks again @Esam_Eid for your efforts and investigation.

Understood from your answer that we need rule for each negate

Test it also and its look working

Thanks!

Yos