Libre - Alert Rule for Logins

Help
1

Hi,

Looked at the Libre Documentation and can’t see anything on this,

Trying to setup an alert for Logins, whether they be successful or unauthorised, however each alert is showing Logins in general from previous days, rather than new logins.

Currently using:

SELECT * FROM devices,syslog WHERE (devices.device_id = ? AND devices.device_id = syslog.device_id) AND syslog.msg LIKE ‘%LOGIN_SUCCESS%’ AND (NOW()) = 1

Is there something I am missing with this?

Any help Is Greatly Appreciated

Cheers,

Andrew

2

Instead the NOW part, use the macros.past_5m in the alert builder

3

Thanks The GreatDoc,

I don’t seem to have that option avaliable, guessing I would need to create that macro in the config.php

(syslog.timestamp >= (DATE_SUB(NOW(),INTERVAL 5 MINUTE))

regards

Andrew

4

Mmmm, im almost sure macros.past_Xm is included by default…

Cant check right now :frowning:

5

image
image872×330 6.72 KB

Do you know how I would setup this macro?

6

Hi The Great Doc,

I found this online
:

SELECT * FROM syslog WHERE (syslog.device_id = ?) && (syslog.timestamp > = (DATE_SUB(NOW(),INTERVAL 5 MINUTE)) && syslog.msg REGEXP “.LOGIN_SUCCESS” )

If I use the override SQL do you think this will work?

Regards

Andrew