Configuring a Log Management Filter Frequency Threshold

Monitor the absence or presence of logs based on the filter query you have saved.

To configure a Log Management Filter Frequency threshold:

Select SETTINGS > Actions & Alerts > Alert Center Libraries from the main menu, then select the Thresholds tab in the interface that appears.
Click the Add icon to launch the Select Threshold Type dialog.
Choose Log Management Filter Frequency from the options displayed, then click Select.
Use the General tab to configure the following threshold settings:

Name. Used in the Threshold library and the title on the Alert Center Dashboard.
Log Filter. Select the desired log filter from filter library using the drop-down menu.
Notification Policy. (Optional) Select the notification policy to apply to this threshold. The policy initiates notifications when an item is outside the configured threshold limits.
Threshold Check Interval. Enter a time interval for Alert Center to check the database for items that are out of the threshold limits.
Tip: Avoid setting the threshold check interval to a very short time, as this can degrade system performance. In general, setting the threshold check interval to less than five minutes is not advised.
Automatically resolve items no longer out of threshold. Select this option if you want Alert Center to automatically resolve items when they return to the value within the threshold limit.

Note: Notification policies are optional for most thresholds. If you do not select a notification policy, no notifications are generated for the threshold, but a dashboard report listing the out of threshold items still appears on the Alert Center Home page.

Condition

Presence/Absence. Enable the desired option to report the threshold as breached when the results of the selected log filter query appear/do not appear with the specified frequency and within the specified duration.
Warning: When Absence is selected, the threshold will be considered breached with a count of zero for enabled log sources that may not be collecting log data. This could result in excessive alerts and notifications depending on your Log Management and Alert Center settings and configuration.
Frequency. Indicates the number of records WhatsUp Gold finds matching the applied filter criteria within the specified duration.
Duration. Specify the length of time in which the results of the log filter query must appear/not appear for a single log source to consider the threshold breached.

Use the Applied Log Sources tab to which log source or sources this threshold should be applied:

Apply this threshold to ALL applicable log sources. Enable this option to apply the threshold to all available log sources.
Exclude log sources. When the threshold is applied to all log sources, you can enable this option, then specify one or more specific sources to be excluded from filter frequency threshold monitoring. Click the Add icon, then select either Groups or Devices. Use the subsequent dialog to select the group(s) or device(s) to exclude depending on your selection.
Apply this threshold to specific log sources. Enable this option to apply the threshold to one or more user-defined log sources.