possible to negate the alert?

[nozlaf]

Alerts only seem to be possible if the query returns a hit, i want to alert if a query does not return a hit


e.g. I want to query for a username in a log, if the user does not login for 20 days I want to send an alert.

is this possible?

[rkennedy]

Sure is! Set the lookback / check interval to 20d with the thresholds at 1: for warning and critical.

[nozlaf]

thanks ill give it a try

[nozlaf]

would help if i had just hovered over the ? right

[mcapra]

Perhaps Though there are significant efforts being made to have the GUI explain topics such as that more effectively.