Issue with Signals in ELK7.8

[jancodenew (jan)]

Hi,

I have 200 rule signals running. There are 80 Elastic default rules and 120 custom rules.

Last response of most of the rules are showing succeeded but last run is 6 days ago and more. There is no error message.

Please help me to resolve this issue.

[yctercero (Yara Tercero)]

Hi @jancodenew ,

Thanks for posting. It may be helpful to get more details on one of the rules you're seeing this happen for to better triage.

• Are the rules you are seeing run as "[ X ] days ago" prepackaged, custom or are you seeing it occur for both?
• What sort of interval is set on the rule?
• Are there any messages under the rule details Failure History tab?
• Has it previously successfully generated alerts?
• If you disable and re-enable one of these rules, do you see any failures?

I believe it was in 7.9+ that we addressed some feedback to make triaging such situations easier. If possible to do so, it could be helpful to update to the latest version.

[jancodenew (jan)]

Replied inline. Please check,

@yctercero

• Are the rules you are seeing run as "[ X ] days ago" prepackaged, custom or are you seeing it occur for both? -----both
• What sort of interval is set on the rule?----5minutes interval and 10min loopback
• Are there any messages under the rule details Failure History tab?-----yes for very few rule count, can say 5%.
• Has it previously successfully generated alerts?----yes
• If you disable and re-enable one of these rules, do you see any failures?-----In that case i used to resolve it by increasing the the loopback and enabling rules as small batches of 5 or 10.

[yctercero (Yara Tercero)]

Hi @jancodenew -

Apologies for the delayed response. Are you continuing to encounter this issue? What were some of the failure messages you mentioned appeared under the rule details of some of the rules that appear to not have run for a long time?