Configure a System Log Check

Get notified when system log entries exceed thresholds

Written By Erdinc Akay

Last updated About 2 months ago

Configure a System Log Check

A System Log Check searches syslog/journald for entries at or above a specific priority level and warns when the count exceeds a threshold. This helps you detect errors and warnings in system logs that indicate problems.

Prerequisites

  • You need the Monitoring Check Management permission. Your administrator assigns permissions under Administration → Groups.
  • The target device must have a connected agent running Linux or macOS.
  • For Windows, use the Event Log Check instead.

Steps

  1. Go to Devices and open the device.
  2. Click the Checks tab → Add Check → System Log.
  3. Configure the check:
FieldDefaultDescription
Lookback period (minutes)60How far back to search the log (1–1440)
Max entries20Maximum number of log entries to evaluate per check run (1–500)
Minimum priority3 (Error)Select one of four syslog priority levels: 0 (Emergency), 2 (Critical), 3 (Error), 4 (Warning)
Warning threshold (under Thresholds)5Number of matching entries that triggers a warning
Critical threshold (under Thresholds)20Number of matching entries that triggers a critical result
  1. Optionally, add patterns under Exclude patterns (in the Filters section) to ignore known harmless messages. Matching is case-insensitive.
  2. Click Add Check.

Tips

  • Set the lookback period to match or exceed the check interval so no entries are missed between runs.
  • The default priority of 3 (Error) is a good starting point. Lower it to 4 (Warning) if you also want to capture warnings.
  • Use exclusion patterns to filter out frequent, known messages that require no action.

After the first check interval, the result appears in the device's Checks tab.

See also: System Log Check Reference