Security Compliance

Create a rule notification when a SEM agent goes offline

This article describes how to create a rule that sends an email alert when a SEM agent goes offline.

First published date

10/18/2018 3:38 PM

Last published date

10/18/2018 3:38 PM

Overview

This article describes how to create a rule that sends an email alert when a Security Event Manager (formerly Log & Event Manager) agent goes offline.

An agent could go offline because the service stopped, the server was shutdown, or the network experienced an outage. If the network experienced an outage (complete disconnection), the agent offline notification will require a timeout period before the notification is sent.

An agent online notification can be configured, but it is less common. If the agent cannot send data to SEM, the agent will queue the log data under the agent "ContegoSPOP" directory. Once the agent is able to connect, all of the queued data will be sent to SEM.

Product section

Security Event Manager

Cause

 

    Resolution

    Create/add a new rule for the event called Internal Agent Offline. 

    There are two ways to accomplish this.

    Simple Rule configuration: 

    Note: This procedure assumes you have previously set up some rules, and have email notifications enabled.

    SEM HTML5 console

    1. In the SEM Events console, click the Rules tab, and then click Create new rule.
    2. In the Rule values search box, enter agent.
    3. Drag InternalAgentOffline into the rules builder to the right.
    4. Drag InternalAgentOnline into the rules builder under InternalAgentOffline.
    5. Next to InternalAgentOnline, click occurred, and then change it to did not occur.
    6. Drag InternalAgentOffline.DetectionIP into the rules builder, and then drag InternalAgentOnline.DetectionIP next to it as shown below.

    7. Click Next to assign actions and complete the rule configuration.
    8. Enter a descriptive name for the rule.
    9. Ensure the rule is set to Enable rule after saving.
    10. Under Actions, click Add new action.
    11. Type email, select Send Email Message, and then click Next.
    12. Select your email template and recipients, and then click Add.
    13. Review your rule settings, and then click Create.
    SEM Flash console
    1. On the SEM console menu bar, navigate to Build > Rules. 
    2. In the top left under Refine Results, enter agent offline.
    3. Under the Templates on the lower right, click the gear icon next to Template: Agent Offline - Server, and then select Clone.
    4. To enable the rule, select the Enable check box  next to the description.
    5. In the Actions box, select one or more email recipients from the Users drop-down list, and then click Save on the bottom right.
    6. To perform a global save of all changed rules, click Activate Rules on the top right (also activates the rule).

    A more automated method for rule construction: 

    1. On the SEM console menu bar, navigate to Build > Rules. 
    2. Click Add Rule.
    3. Click the IT Operations tab, select the General Best Practice check box, and then click Next.
    4. Configure email settings and verify that it is working.
    5. Select one or more email recipients, and then click Finish.
    6. In the search bar on the left pane, type agent.
    7. Select InternalAgentOffline and drag it to the Correlations box.
    8. Leave the Correlation Time as it is.
    9. In the Actions box, select Send Email Message and drag the InternalAgentOffline events under the $EventInfo field.
    10. Do the same for Detection Time.
    11. Click Save.
    12. Click Activate Rules in the top right.

    In case you do want the Agent Online notification:

    1. On the SEM console menu bar, navigate to Build > Rules. 
    2. In the top right, click the Plus sign to add a new rule.
    3. At the top under the main part of the page, enter a name like Agent Online.
    4. Under Rule Creation on the left, enter InternalAgent in the Events group search box.
    5. Select InternalAgentOnline, and then drag it into the Correlations box (make sure there is a green check for this event).
    6. Select InternalAgentOffline, and then drag it into the Correlations box, but select the green check mark to change it to a red X.
    7. Select InternalAgentOnline, and then select DetectionIP in the Fields list below, and then drag to the Correlations box.
    8. Select InternalAgenOffline, and then select DetectionIP in the Fields list below, and drag to the pencil field next to the InternalAgentOnline that you placed in the Correlations box.
    9. Next to the description field, select the Enable check box to enable the rule.
    10. In the left panel, click to expand the Actions list, and then drag Send Email Message into the Actions box.
    11. Select the Agent Offline Dell Phone Messages email template, or create your own template.
    12. From the Events list, select InternalAgentOnline, drag the AgentAddress from the Fields list below into the blank area to the right of $Agent under the email action.
    13. From the Fields list, drag the DetectionTime into the $time field under the email action.
    14. In the Actions box, select one or more recipients from the Users drop-down list, and then click Save.
    15. To perform a global save of all changed rules, click Activate Rules on the top right (also activates the rule).