# Issue with Signals in ELK7.8

**URL:** <https://discuss.elastic.co/t/issue-with-signals-in-elk7-8/266699>\
**Category:** SIEM\
**Created:** [March 9, 2021, 1:00pm UTC](https://discuss.elastic.co/t/issue-with-signals-in-elk7-8/266699 "2021-03-09T13:00:05Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![jancodenew](https://avatars.discourse-cdn.com/v4/letter/j/87869e/32.png) [@jancodenew](https://discuss.elastic.co/u/jancodenew)\
**Post date:** [March 9, 2021, 1:00pm UTC](https://discuss.elastic.co/t/issue-with-signals-in-elk7-8/266699/1 "2021-03-09T13:00:05Z")

</div>

Hi,

I have 200 rule signals running. There are 80 Elastic default rules and 120 custom rules.

Last response of most of the rules are showing succeeded but last run is 6 days ago and more. There is no error message.

Please help me to resolve this issue.

---

<div class="post-metadata">

**Author:** ![yctercero](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yctercero/32/68560_2.png) [@yctercero](https://discuss.elastic.co/u/yctercero)\
**Post date:** [March 9, 2021, 4:10pm UTC](https://discuss.elastic.co/t/issue-with-signals-in-elk7-8/266699/2 "2021-03-09T16:10:34Z")

</div>

Hi @jancodenew ,

Thanks for posting. It may be helpful to get more details on one of the rules you're seeing this happen for to better triage.

- Are the rules you are seeing run as "[X] days ago" prepackaged, custom or are you seeing it occur for both?
- What sort of interval is set on the rule?
- Are there any messages under the rule details `Failure History` tab?
- Has it previously successfully generated alerts?
- If you disable and re-enable one of these rules, do you see any failures?

I believe it was in 7.9+ that we addressed some feedback to make triaging such situations easier. If possible to do so, it could be helpful to update to the latest version.

---

<div class="post-metadata">

**Author:** ![jancodenew](https://avatars.discourse-cdn.com/v4/letter/j/87869e/32.png) [@jancodenew](https://discuss.elastic.co/u/jancodenew)\
**Post date:** [March 16, 2021, 6:32am UTC](https://discuss.elastic.co/t/issue-with-signals-in-elk7-8/266699/3 "2021-03-16T06:32:02Z")

</div>

Replied inline. Please check,

> [@yctercero](#):
>
> - Are the rules you are seeing run as "[X] days ago" prepackaged, custom or are you seeing it occur for both? -----both
> - What sort of interval is set on the rule?----5minutes interval and 10min loopback
> - Are there any messages under the rule details `Failure History` tab?-----yes for very few rule count, can say 5%.
> - Has it previously successfully generated alerts?----yes
> - If you disable and re-enable one of these rules, do you see any failures?-----In that case i used to resolve it by increasing the the loopback and enabling rules as small batches of 5 or 10.

---

<div class="post-metadata">

**Author:** ![yctercero](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yctercero/32/68560_2.png) [@yctercero](https://discuss.elastic.co/u/yctercero)\
**Post date:** [March 23, 2021, 11:02pm UTC](https://discuss.elastic.co/t/issue-with-signals-in-elk7-8/266699/4 "2021-03-23T23:02:33Z")

</div>

Hi @jancodenew -

Apologies for the delayed response. Are you continuing to encounter this issue? What were some of the failure messages you mentioned appeared under the rule details of some of the rules that appear to not have run for a long time?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 20, 2021, 11:02pm UTC](https://discuss.elastic.co/t/issue-with-signals-in-elk7-8/266699/5 "2021-04-20T23:02:50Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.