LogAlert Groups

LogAlert Groups help you organize logs that you want to monitor for specific conditions. You can apply a LogAlert Group to resources or resource groups and use filters to identify the relevant logs.

Within a LogAlert Group, LogAlerts define the conditions that trigger alerts. For example, you can create a LogAlert that triggers when a log message contains specific text.

You can configure LogAlert Groups to monitor logs from one or more log partitions. Your partition permissions determine which partitions you can access and modify.

If a LogAlert Group references a partition that you cannot access, the partition displays as Restricted Partition. When you update the LogAlert Group, LogicMonitor preserves the restricted partition mappings and allows you to modify the partitions that you can access.

If you have Manage permission for the LogAlert Group, you can delete the group even when it references restricted partitions. Manage permission does not provide access to the restricted partitions or their log data.

Considerations for LogAlert Groups

• Each partition supports up to 20 LogAlert Groups. Each LogAlert Group supports up to 55 LogAlerts, including up to 10 window alerts and 10 stateful alerts. Consolidate existing LogAlert Group conditions or reduce usage within the partition to meet these limit.
• If a LogAlert Group contains more partitions than can be previewed, the preview uses up to five partitions. The preview does not change the partitions configured for the LogAlert Group.
• You can create LogAlert Groups for unmapped resources. When no LogicMonitor-monitored resource or resource group exists, LogicMonitor automatically associates the LogAlert Group with a system-generated resource and resource group.
• The resource name matches the LogAlert Group name. The resource group for unmapped resources is called LogAlert GroupResources.
  For more information, see Deviceless Logs.
• LogAlert Groups and LogAlerts are evaluated for every received log. To maintain performance, define LogAlert Groups with specific scope, by limiting them to relevant device types and associated LogAlerts.
• Avoid broad definitions when logs cannot match the alert criteria. For example, Windows Event Logs do not match Syslog facility-based conditions.

Viewing LogAlert Groups

You can view and manage LogAlerts from the LogAlert Groups & LogAlerts page, available on the Logs Management page.

The LogAlert Groups & LogAlerts page provides a consolidated view of LogAlert Groups and their associated LogAlerts. From this page, you can view, filter, add, edit, and delete LogAlerts and expand LogAlert rows to view additional information.

The LogAlerts table displays the following information:

• Severity—Displays the severity configured for the LogAlert: Critical, Error, or Warning.
• Display As—Displays the configured display name for the LogAlert.
• Logs query—Displays the logs query used to identify log events that trigger the LogAlert.
• LogAlert type—Displays the configured LogAlert type, such as Basic or Stateful.
• Description—Displays the description of the LogAlert.
• Active—Indicates whether the LogAlert is active. Toggle the setting to activate or deactivate the LogAlert.
• Actions—Provides options to manage the LogAlert. Select edit to view or modify the LogAlert configuration.

For information about managing LogAlerts Groups, see LogAlert Groups and LogAlerts Management.

Adding LogAlert Groups

You can add LogAlert Groups either from the Logs page or LogAlert Groups & LogAlerts page:

• From a log event or anomaly on the Logs page:
  1. In LogicMonitor, navigate to Logs and run a query.
  2. Select the log event or anomaly, and then open the corresponding Resource, Resource Type or Groups menu.
  3. Select  Create LogAlert Group.
     The Add LogAlert Group dialog opens with the Logs query field prefilled with matching events for the selected resource or groups.
  4. In the Name and Description fields, enter a name and description for the LogAlert Group.
  5. In Partitions, select the partitions to include in the log query.
  6. In Logs query field, define the events to match using the logs query language. For more information, see Query Language Overview.
  7. Select Run Query to preview the query results. Refine the query as needed.
     The LogAlert group is created as per the configuration.
     
     
• From the LogAlert Groups & LogAlerts page:
  1. In LogicMonitor, navigate to Logs > More Options > Logs Management > LogAlert Groups & LogAlerts.
  2. On the LogAlert Groups & LogAlerts page, select Add LogAlert group.
     The Add LogAlert Group panel displays.
  3. In the Name and Description fields, enter a name and description for the LogAlert Group.
  4. In Partitions, select the partitions to include in the log query.
  5. In Logs query field, define the events to match using the logs query language. For more information, see Query Language Overview.
  6. Select Run Query to preview the query results. Refine the query as needed.
     If the LogAlert Group contains more than five partitions, select up to five partitions to preview the query.
  7. Select Save.
     
     The LogAlert Group displays on the LogAlert Groups & LogAlerts page.
     For more information, see LogAlert Groups and LogAlerts Management.

After adding a LogAlert Group, continue by defining its LogAlerts. For more information, see LogAlerts.