I can see that in Admin we have a tab for Event Sources and in Event Sources we have:
Discovery / Manage / Monitoring Policies / Alarms / Settings / Log Parser Rules
My question is:
Its possible to create a policie to see an event source?
For example in the Manage Tab we have the Event Source the Event Source Type and the log collector and log decoder like this table:
Event Souce Event Source Type Log Collector Log Decoder
126.96.36.199 apache Logdecoder1 LogDecoder 1
I want to create an alarm that can tell me that the Event Souce 188.8.131.52 in apached stopped sending logs or the quantity has diminished .
Is that possible? How?