Page 1 of 1

Couple quick questions

Posted: Fri Feb 13, 2015 2:19 pm
by BanditBBS
Don't even have my first cluster done being purchased and have question for a second cluster.....

1.) Can we remove any ability for someone to click anything in the gui that allows clearing logs?
2.) If we need to keep logs from ~50 linux servers for 7 years, anyone have a best guess how much storage that'll use? Just guessing, I know since no idea how much it'll actually be sending
3.) Is there a method to alert an admin if a source hasn't sent logs in the last x minutes? Custom query perhaps looking for a specific source and alert if it finds nothing?

A new customer we may be getting is asking these three items. I don't even know where to delete logs anyway for #1, but it there is a method in the GUI is it able to be removed?

Re: Couple quick questions

Posted: Fri Feb 13, 2015 2:39 pm
by scottwilkerson
BanditBBS wrote:1.) Can we remove any ability for someone to click anything in the gui that allows clearing logs?
This is already not possible if you are not an admin.
BanditBBS wrote:2.) If we need to keep logs from ~50 linux servers for 7 years, anyone have a best guess how much storage that'll use? Just guessing, I know since no idea how much it'll actually be sending
Yep, it's a loaded question without knowing what the average amount of logs each server will send. Then it would be that number * ~50 servers * 365 * 7 years * 2 (primary and replica ) * extra buffer. On the plus side, you can always add additional nodes to the cluster as time goes on, and it will rebalance automatically, and you can add additional space to existing instances
http://assets.nagios.com/downloads/nagi ... Server.pdf
BanditBBS wrote:3.) Is there a method to alert an admin if a source hasn't sent logs in the last x minutes? Custom query perhaps looking for a specific source and alert if it finds nothing?
We have on the roadmap to make this easier, but the standard alerting takes all nagios plugin threshold syntax so you can create alerts if less than a certain quantity of results are found, so you just create a query targeting just host/_type or whatever.