Nagios Support Forum

Dear customer support,

Is it possible somehow to write alerts based on aggregated queries in Nagios Log Server?
ie: Alerts when one of our users loged in more than 10 times in 5 minutes. I have not find solution for that.

Thanks in advanced!

Best Regards,
Zoli

Alerts are based on the number of returned objects. So you can manually write a query and test it locally on the Elasticsearch system and then input it into the Alert in the NLS GUI. I don't know if an aggregate would work properly, because it would only return the aggregated amount. You'd want to return each log object for the times they logged in. Really you just need to query the user, get the logs that shows they logged in, and then set that query up in the Alert.