Hi,
We need to create an alert to check if tomcat is up and running. This we could identify using pid.
If tomcat is up and running, then we would receive tomcat events (logs) with pid.
If tomcat is down, we wont receive any event.
Can you please help us with the search for this?
Base query below, but this does not work because whenever Tomcat is down, we won't get any events. We may need to use something like fillnull?
index=idne1 source=ps host=host1 OR host=host2* apache-tomcat
|stats count(pid) as Count by host _time
|where count <1
↧