{"action":"created","issue":{"url":"https://api.github.com/repos/ntop/ntopng/issues/1658","repository_url":"https://api.github.com/repos/ntop/ntopng","labels_url":"https://api.github.com/repos/ntop/ntopng/issues/1658/labels{/name}","comments_url":"https://api.github.com/repos/ntop/ntopng/issues/1658/comments","events_url":"https://api.github.com/repos/ntop/ntopng/issues/1658/events","html_url":"https://github.com/ntop/ntopng/issues/1658","id":297736473,"node_id":"MDU6SXNzdWUyOTc3MzY0NzM=","number":1658,"title":"Alerts On Syslog does not provide option to send syslog to remote collector","user":{"login":"deepak-eventtracker","id":17782428,"node_id":"MDQ6VXNlcjE3NzgyNDI4","avatar_url":"https://avatars1.githubusercontent.com/u/17782428?v=4","gravatar_id":"","url":"https://api.github.com/users/deepak-eventtracker","html_url":"https://github.com/deepak-eventtracker","followers_url":"https://api.github.com/users/deepak-eventtracker/followers","following_url":"https://api.github.com/users/deepak-eventtracker/following{/other_user}","gists_url":"https://api.github.com/users/deepak-eventtracker/gists{/gist_id}","starred_url":"https://api.github.com/users/deepak-eventtracker/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/deepak-eventtracker/subscriptions","organizations_url":"https://api.github.com/users/deepak-eventtracker/orgs","repos_url":"https://api.github.com/users/deepak-eventtracker/repos","events_url":"https://api.github.com/users/deepak-eventtracker/events{/privacy}","received_events_url":"https://api.github.com/users/deepak-eventtracker/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":{"login":"simonemainardi","id":3397663,"node_id":"MDQ6VXNlcjMzOTc2NjM=","avatar_url":"https://avatars0.githubusercontent.com/u/3397663?v=4","gravatar_id":"","url":"https://api.github.com/users/simonemainardi","html_url":"https://github.com/simonemainardi","followers_url":"https://api.github.com/users/simonemainardi/followers","following_url":"https://api.github.com/users/simonemainardi/following{/other_user}","gists_url":"https://api.github.com/users/simonemainardi/gists{/gist_id}","starred_url":"https://api.github.com/users/simonemainardi/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/simonemainardi/subscriptions","organizations_url":"https://api.github.com/users/simonemainardi/orgs","repos_url":"https://api.github.com/users/simonemainardi/repos","events_url":"https://api.github.com/users/simonemainardi/events{/privacy}","received_events_url":"https://api.github.com/users/simonemainardi/received_events","type":"User","site_admin":false},"assignees":[{"login":"simonemainardi","id":3397663,"node_id":"MDQ6VXNlcjMzOTc2NjM=","avatar_url":"https://avatars0.githubusercontent.com/u/3397663?v=4","gravatar_id":"","url":"https://api.github.com/users/simonemainardi","html_url":"https://github.com/simonemainardi","followers_url":"https://api.github.com/users/simonemainardi/followers","following_url":"https://api.github.com/users/simonemainardi/following{/other_user}","gists_url":"https://api.github.com/users/simonemainardi/gists{/gist_id}","starred_url":"https://api.github.com/users/simonemainardi/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/simonemainardi/subscriptions","organizations_url":"https://api.github.com/users/simonemainardi/orgs","repos_url":"https://api.github.com/users/simonemainardi/repos","events_url":"https://api.github.com/users/simonemainardi/events{/privacy}","received_events_url":"https://api.github.com/users/simonemainardi/received_events","type":"User","site_admin":false}],"milestone":null,"comments":2,"created_at":"2018-02-16T10:16:54Z","updated_at":"2018-08-23T11:14:19Z","closed_at":"2018-08-23T11:14:19Z","author_association":"NONE","body":"Hi,\r\n\r\nI see option in ntopng \"Alerts On Syslog\" which writes alerts to syslog on linux.\r\nBut in case of windows i don't see it writing anywhere in eventlog or in file.\r\nIs Alerts On Syslog deature applicable in windows version of ntopng? is there any other configuration required for this?\r\n\r\nThanks,\r\nDeepak jha"},"comment":{"url":"https://api.github.com/repos/ntop/ntopng/issues/comments/415378969","html_url":"https://github.com/ntop/ntopng/issues/1658#issuecomment-415378969","issue_url":"https://api.github.com/repos/ntop/ntopng/issues/1658","id":415378969,"node_id":"MDEyOklzc3VlQ29tbWVudDQxNTM3ODk2OQ==","user":{"login":"simonemainardi","id":3397663,"node_id":"MDQ6VXNlcjMzOTc2NjM=","avatar_url":"https://avatars0.githubusercontent.com/u/3397663?v=4","gravatar_id":"","url":"https://api.github.com/users/simonemainardi","html_url":"https://github.com/simonemainardi","followers_url":"https://api.github.com/users/simonemainardi/followers","following_url":"https://api.github.com/users/simonemainardi/following{/other_user}","gists_url":"https://api.github.com/users/simonemainardi/gists{/gist_id}","starred_url":"https://api.github.com/users/simonemainardi/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/simonemainardi/subscriptions","organizations_url":"https://api.github.com/users/simonemainardi/orgs","repos_url":"https://api.github.com/users/simonemainardi/repos","events_url":"https://api.github.com/users/simonemainardi/events{/privacy}","received_events_url":"https://api.github.com/users/simonemainardi/received_events","type":"User","site_admin":false},"created_at":"2018-08-23T11:14:19Z","updated_at":"2018-08-23T11:14:19Z","author_association":"MEMBER","body":"> Actually here is what I am trying to achieve.\r\n> •\tI have installed ntopng on centos and I have enabled default alerts.\r\n> •\tI have enabled feature “Alerts On Syslog”, So it writes alerts to Linux system log whenever alert is generated and same is forwarded to remote syslog receiver(EventTracker) by adding remote hostname in rsyslog.conf file.\r\n> •\tAbove works fine.\r\n\r\ncorrect, configuring the rsyslog.conf is the proper way to instruct syslog to deliver events to remote syslog collectors.\r\n\r\n\r\n> •\tNow next thing what I want is I want those alerts to bring to SIEM(EventTracker),I can achieve this by reading event log on windows or from the logfile.\r\n> •\tI want to know whether ntopng will also write alerts it to eventlog or in any file.\r\n\r\nOn windows there's no concept of syslog and alerts are not written to file. For this reason, in order to retrieve the exising alerts under Windows, the recommended way is to query endpoint `get_alerts_data.lua` to have an easy-to-parse JSON representation of the alerts detected:\r\n\r\n```\r\nhttp://devel:3000/lua/get_alerts_data.lua?status=historical&currentPage=1&perPage=10&sortColumn=column_date&sortOrder=desc\r\n```\r\n\r\nThe most important parameter you can control is the `status`, that allows you to chose between currently `engage`d alerts, past `historical` alerts and `historical-flows` alerts.\r\n\r\nSo basically if you want to retrieve engaged alerts, all you have to do is to query as\r\n\r\n```\r\nhttp://devel:3000/lua/get_alerts_data.lua?status=engaged&currentPage=1&perPage=10&sortColumn=column_date&sortOrder=desc\r\n```\r\n\r\nThe other parameters are pretty intuitive and are used to paginate and sort the result set.\r\n\r\nThe endpoint mentioned above is the one used by the web UI to populate the alerts page\r\n\r\n![image](https://user-images.githubusercontent.com/3397663/44522288-5095b200-a6d6-11e8-85aa-54767c83a0da.png)\r\n\r\nSo you can be sure you'll always get all the results.\r\n\r\n"}}
{"actor":{"display_login":"simonemainardi"}}