Add alarm detecting too many failed logins
Change-Id: I9c623d6d604ac1b3f6d226cfb27d0ccaf809ead7
diff --git a/rsyslog/meta/heka.yml b/rsyslog/meta/heka.yml
index 3c31c40..e748d27 100644
--- a/rsyslog/meta/heka.yml
+++ b/rsyslog/meta/heka.yml
@@ -43,3 +43,20 @@
config:
hostname: '{{ grains.host }}'
grace_interval: 30
+metric_collector:
+ trigger:
+ failed_logins_warning:
+ description: 'The rate of failed logins is too high.'
+ severity: warning
+ rules:
+ - metric: failed_logins_rate
+ relational_operator: '>='
+ threshold: 0.2
+ window: 120
+ periods: 0
+ function: avg
+ alarm:
+ failed_logins:
+ alerting: enabled
+ triggers:
+ - failed_logins_warning