topic Re: CSA - Alerting when host stops polling in Network Security

CSA - Alerting when host stops polling

michael.saunders — Sun, 10 Mar 2019 11:30:23 GMT

I'd like to know when a host stops polling into the CSA MC. Is it possible to create an alert to be sent via email or an SNMP trap when an agent hasn't polled into the MC for a specified period of time?

-Mike

Re: CSA - Alerting when host stops polling

tsteger1 — Fri, 13 Feb 2009 22:15:12 GMT

Hi Mike,

A quick solution for now is to create an event set and email alert using the event type 'Management Center: Hosts not actively polling found' that will email you with a list of inactive hosts. The event is generated every 24 hours and contains all hosts not activelty polling.

Hosts are considered inactive if they have missed three polling intervals or not polled the MC in the past 24 hours.

Without digging further I don't know of other options.

Tom

Re: CSA - Alerting when host stops polling

michael.saunders — Fri, 13 Feb 2009 22:20:19 GMT

Tom,

Without trying it yet, this already sounds like what I need to do the job. I will give it a test and let you know how it shakes out. Thanks!

-MS

Re: CSA - Alerting when host stops polling

jan.nielsen — Sun, 15 Feb 2009 22:23:17 GMT

Another (not so simple option), is to use the csaapi, you could create a script that polls the list of hosts, and then look for how long it has been since last poll, and then mail or snmp trap a msg to someone, of course you won't get any info faster than at least one poll period, as the client is not supposed to poll the csamc in between that interval.

Re: CSA - Alerting when host stops polling

michael.saunders — Mon, 16 Feb 2009 18:33:52 GMT

Tom,

That worked. I had tried to create an alert using a similar method in the past but I didn't have it configured correctly. This appears to work for my needs.

Thanks!

-MS

Re: CSA - Alerting when host stops polling

tsteger1 — Tue, 17 Feb 2009 03:49:59 GMT

You are quite welcome Mike!

Glad to hear it worked for you.

Tom