log-queries/queryPackNetwork.json at main · logicmonitor/log-queries · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
[
    {
        "label": "Network Syslog IPSEC or OpenVPN events",
        "duration": "24hour",
        "query": "_lm.logsource_type=\"syslog\" and (IPSEC or OpenVPN) | count by _resource.name | sort by _count desc",
        "UseCase": "",
        "commentGroup": "Network",
        "commentQueryType": "Aggregate"
    },
    {
        "label": "Network Syslog Duplex Mismatch or VLAN Mismatch",
        "duration": "1hour",
        "query": "_lm.logsource_type=\"syslog\" and (duplex or mismatch) | count by _resource.name | sort by _count desc",
        "UseCase": "",
        "commentGroup": "Network",
        "commentQueryType": "Aggregate"
    },
    {
        "label": "Network Bad Keywords",
        "duration": "24hour",
        "query": "_lm.logsource_type=\"syslog\" and (\"error\" or \"fail\" or \"critical\" or \"fatal\" or \"terminate\" or \"kill\" or \"exception\" or \"timeout\")",
        "UseCase": "",
        "commentGroup": "Network",
        "commentQueryType": "Basic"
    }
]