How to alert when we STOP receiving logs?

Question

We recently had an issue where we needed to review logs from a router during a P1 outage, but found that LM had stopped receiving logs from the device 2 weeks ago.

We need a way to have a "No Data" type of alert for logs, so that if a device stops sending us logs we can be notified and resolve the issue. Instead of finding out 2 weeks later when the logs are needed during an outage.

We can't use the Log Usage datasource for this because it is based on push metrics and does not have a collection interval.

Joe Williams · Accepted Answer

The built in way would be to create a tracked query and alert on that. That tho isn't really scalable if you have to worry about a lot of random devices. So we ended up writing a DataSource, that uses the LM API to query itself to return how many hours ago it last received something. It isn't the cleanest thing in the world, but it gets the job done. You have to change line 20 to match whatever the ID is for Log Usage. Now this only accounts for Log Usage, not a specific log source. So any logs...