No Alert from Syslog Message

[Chas]

There is a bug in the builder

[Solved] Problem with Syslog alert rule

I had the same problem a few days ago, basically I think “macros.past_5m” shouldn’t be in quotes, for some reason the GUI adds it. When creating the alert, I just chose Import from old syntax, and put in the query like this, syslog.timestamp >= macros.past_5m AND syslog.msg REGEXP ".segfault." My query does have a timestamp with the output of %value.string but no way to pull it out separately that i can find. Perhaps this is configurable on either syslog or the box itself. The only other way …

as a work around enclose ` around so it looks like this `macros.past_5m` , Or use my suggestion in the other thread.

I also don’t think you want to use delay, try
Max: -1
Delay: 0
Interval: 360