Skip to content

Rename Health events to Account events #5582

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Rename Health events to Account events #5582

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion blog-cse/2024/12-31.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -76,7 +76,7 @@ This content release:
- Alert Logic
- Google G Suite Alert Center
- Microsoft Defender Advanced Hunting
- Azure Provisioning, Alert, ResourceHealth, and ServiceHealth events
- Azure Provisioning, Alert, ResourceHealth, and Service Account events

Changes are enumerated below.

Expand Down
28 changes: 14 additions & 14 deletions docs/api/health-events.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
---
id: health-events
title: Health Events Management APIs
sidebar_label: Health Events
description: Use HTTP endpoints to view your account's health events.
id: account-events
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If you're changing the ID of this file from health-events to account-events, you should also change the name of the file from health-events.md to account-events.md.

title: Account Events Management APIs
sidebar_label: Account Events
description: Use HTTP endpoints to view your account's account events.
---

import useBaseUrl from '@docusaurus/useBaseUrl';
Expand All @@ -11,23 +11,23 @@ import ApiRoles from '../reuse/api-roles.md';

<img src={useBaseUrl('img/icons/company-value/heart-wellness.png')} alt="Thumbnail icon" width="50"/>

The [Health Events](/docs/manage/health-events) Management API allows you to view the health of your Collectors and Sources from HTTP endpoints.
The [Account Events](/docs/manage/account-events) Management API allows you to view the health of your Collectors and Sources from HTTP endpoints.

## Documentation

<ApiIntro/>

| Deployment | Documentation URL |
|:------------|:------------------------------------------------------|
| AU | https://api.au.sumologic.com/docs/#tag/healthEvents |
| CA | https://api.ca.sumologic.com/docs/#tag/healthEvents |
| DE | https://api.de.sumologic.com/docs/#tag/healthEvents |
| EU | https://api.eu.sumologic.com/docs/#tag/healthEvents |
| FED | https://api.fed.sumologic.com/docs/#tag/healthEvents |
| JP | https://api.jp.sumologic.com/docs/#tag/healthEvents |
| KR | https://api.kr.sumologic.com/docs/#tag/healthEvents |
| US1 | https://api.sumologic.com/docs/#tag/healthEvents |
| US2 | https://api.us2.sumologic.com/docs/#tag/healthEvents |
| AU | https://api.au.sumologic.com/docs/#tag/accountEvents |
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is not going to work since these API docs link are generated from backend and this would require changing the health events API. Is this something that is being planned for future? @SumoLogic/core-platform team owns these APIs and as far as I know this hasn't been communicated to the team that owns these APIs?

| CA | https://api.ca.sumologic.com/docs/#tag/accountEvents |
| DE | https://api.de.sumologic.com/docs/#tag/accountEvents |
| EU | https://api.eu.sumologic.com/docs/#tag/accountEvents |
| FED | https://api.fed.sumologic.com/docs/#tag/accountEvents |
| JP | https://api.jp.sumologic.com/docs/#tag/accountEvents |
| KR | https://api.kr.sumologic.com/docs/#tag/accountEvents |
| US1 | https://api.sumologic.com/docs/#tag/accountEvents |
| US2 | https://api.us2.sumologic.com/docs/#tag/accountEvents |


## Required role capabilities
Expand Down
2 changes: 1 addition & 1 deletion docs/api/index.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -96,7 +96,7 @@ Use the Sumo Logic Application Programming Interfaces (APIs) to interact with ou
</div>
<div className="box smallbox card">
<div className="container">
<a href="/docs/api/health-events"><img src={useBaseUrl('img/icons/company-value/heart-wellness.png')} alt="Thumbnail icon" width="50"/><h4>Health Events</h4></a>
<a href="/docs/api/account-events"><img src={useBaseUrl('img/icons/company-value/heart-wellness.png')} alt="Thumbnail icon" width="50"/><h4>Account Events</h4></a>
</div>
</div>
<div className="box smallbox card">
Expand Down
2 changes: 1 addition & 1 deletion docs/get-started/sumo-logic-ui-classic.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -242,7 +242,7 @@ To manage data in Sumo Logic, do the following:
* **Collection.** [Manage collectors and sources](/docs/send-data/collection).
* **Logs.** Manage [fields](/docs/manage/fields), [field extraction rules](/docs/manage/field-extractions), [partitions](/docs/manage/partitions), [scheduled views](/docs/manage/scheduled-views), [connections](/docs/alerts/webhook-connections), and [data forwarding](/docs/manage/data-forwarding).
* **Metrics.** Manage metrics rules, [logs-to-metrics](../metrics/logs-to-metrics.md), and [metrics transformation rules](../metrics/metrics-transformation-rules.md).
* **Monitoring.** [Monitors](/docs/alerts/monitors), [connections](/docs/alerts/webhook-connections), and [health events](/docs/manage/health-events).
* **Monitoring.** [Monitors](/docs/alerts/monitors), [connections](/docs/alerts/webhook-connections), and [account events](/docs/manage/account-events).

### Admin: Manage accounts, users, and security

Expand Down
2 changes: 1 addition & 1 deletion docs/get-started/sumo-logic-ui.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -89,7 +89,7 @@ Use the **Go To...** menu for quick access to settings and features. <img src={u

With the Sumo Logic Administrator role, you can manage your organization's data collection settings, ingest budget, partitions, and more. To access these settings, go to the top nav bar and click the **Configuration** icon.<br/><img src={useBaseUrl('img/get-started/config.png')} alt="config.png" width="300"/>

* **Collection**. [Collection](/docs/send-data/collection/), [OpenTelemetry Collection](/docs/send-data/opentelemetry-collector/), [Source Template](/docs/send-data), [Status](/docs/manage/ingestion-volume/collection-status-page/), [Ingest Budget](/docs/manage/ingestion-volume/ingest-budgets/), [Health Events](/docs/manage/health-events/), [Archive](/docs/manage/data-archiving/archive), [Data Archiving](/docs/manage/data-archiving/).
* **Collection**. [Collection](/docs/send-data/collection/), [OpenTelemetry Collection](/docs/send-data/opentelemetry-collector/), [Source Template](/docs/send-data), [Status](/docs/manage/ingestion-volume/collection-status-page/), [Ingest Budget](/docs/manage/ingestion-volume/ingest-budgets/), [Account Events](/docs/manage/account-events/), [Archive](/docs/manage/data-archiving/archive), [Data Archiving](/docs/manage/data-archiving/).
* **Logs**. [Fields](/docs/manage/fields/), [Field Extraction Rules](/docs/manage/field-extractions/), [Partitions](/docs/manage/partitions/), [Scheduled Views](/docs/manage/scheduled-views/), [Data Forwarding](/docs/manage/data-forwarding/), [Threat Intelligence](/docs/security/threat-intelligence/).
* **Metrics**. [Metrics Rules](/docs/metrics/metric-rules-editor/), [Logs-to-Metrics](/docs/metrics/logs-to-metrics/), [Metrics Transformation Rules](/docs/metrics/metrics-transformation-rules/).
* **Monitoring**. [Connections](/docs/alerts/webhook-connections).
Expand Down
2 changes: 1 addition & 1 deletion docs/integrations/saas-cloud/sumo-collection.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@ This app includes [built-in monitors](#sumo-collection-monitors). For details on
:::

:::tip
For related info on collector health events, see [this doc](/docs/manage/health-events).
For related info on collector account events, see [this doc](/docs/manage/account-events).
:::

## Log types
Expand Down
51 changes: 25 additions & 26 deletions docs/manage/health-events.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
---
id: health-events
title: Health Events
id: account-events
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just like for that other file, if you're changing the ID of this file from health-events to account-events, you should also change the name of the file from health-events.md to account-events.md.

title: Account Events
description: Monitor the health of your Collectors and Sources.
---

Expand All @@ -11,50 +11,49 @@ description: Monitor the health of your Collectors and Sources.
| CloudFlex | Professional, Enterprise |
| Credits | Trial, Essentials, Enterprise Operations, Enterprise Security, Enterprise Suite |

Health events allow you to keep track of the health of your Collectors, Sources, and Ingest Budgets. You can use them to find and investigate common errors and warnings that are known to cause collection issues. 
System events allow you to keep track of the health of your Collectors, Sources, and Ingest Budgets. You can use them to find and investigate common errors and warnings that are known to cause collection issues. 

This framework includes the following:

* Health event logs indexed in the [System Event Index](/docs/manage/security/audit-indexes/system-event-index).
* A [health events table](#health-events-table) on the Alerts page.
* A health status column on the [Collection page](#collection-page).
* Account event logs indexed in the [Account Event Index](/docs/manage/security/audit-indexes/account-event-index).
* A [account events table](#account-events-table) on the Alerts page.
* A account status column on the [Collection page](#collection-page).

Health events are sent from Installed Collectors on version 19.308-2 and
later.
Account events are sent from Installed Collectors on version 19.308-2 and later.

## Alerts

Alerts for specific health events are easy to create in the Health Events Table. The details pane of an event provides a **Create Scheduled Search** button to automatically generate the required query.
Alerts for specific account events are easy to create in the Account Events Table. The details pane of an event provides a **Create Scheduled Search** button to automatically generate the required query.

## Health events
## Account events

Health events are created when an issue is detected with a Collector or Source. Events are indexed and searchable in a separate partition named **sumologic_system_events** in the [System Event Index](/docs/manage/security/audit-indexes/system-event-index). For details on what information is available in a health event, see the [common parameters](#common-parameters) table.
Account events are created when an issue is detected with a Collector or Source. Events are indexed and searchable in a separate partition named **sumologic_system_events** in the [Account Event Index](/docs/manage/security/audit-indexes/account-event-index). For details on what information is available in a health event, see the [common parameters](#common-parameters) table.

### Health events table
### Account events table

The health events table allows you to easily view and investigate problems getting your data to Sumo.
The account events table allows you to easily view and investigate problems getting your data to Sumo.

On the health events table, you can search, filter, and sort incidents by key aspects like severity, resource name, event name, resource type, and opened since date.
On the account events table, you can search, filter, and sort incidents by key aspects like severity, resource name, event name, resource type, and opened since date.

[**Classic UI**](/docs/get-started/sumo-logic-ui-classic). To access the health events table, in the main Sumo Logic menu select **Manage Data > Monitoring > Health Events**.
[**Classic UI**](/docs/get-started/sumo-logic-ui-classic). To access the account events table, in the main Sumo Logic menu select **Manage Data > Monitoring > Health Events**.

[**New UI**](/docs/get-started/sumo-logic-ui/). To access the health events table, in the top menu select **Configuration**, and then under **Data Collection** select **Health Events**. You can also click the **Go To...** menu at the top of the screen and select **Health Events**.
[**New UI**](/docs/get-started/sumo-logic-ui/). To access the account events table, in the top menu select **Configuration**, and then under **Data Collection** select **Account Events**. You can also click the **Go To...** menu at the top of the screen and select **Account Events**.


![health events table.png](/img/health-events/health-events-table.png)
![account events table.png](/img/health-events/health-events-table.png)

Click on a row to view the details of a health event.

![health event detail.png](/img/health-events/health-event-detail.png)

Click the **Create Scheduled Search** button on the details pane to get alerts for specific health events. The unique identifier of the resource, such as the Source or Collector, is used in the query. See [Schedule a Search](../alerts/scheduled-searches/schedule-search.md) for details.
Click the **Create Scheduled Search** button on the details pane to get alerts for specific account events. The unique identifier of the resource, such as the Source or Collector, is used in the query. See [Schedule a Search](../alerts/scheduled-searches/schedule-search.md) for details.

Under the **More Actions** menu you can select:

* **Event History** to run a search against the **sumologic_system_events** partition to view all of the related event logs.
* **View Object** to view the Collector or Source in the Collection page related to the event.

### Health events severity
### Account events severity

Events are categorized by two severity levels, warning and error. The severity column has color-coded error and warning events so you can quickly determine the severity of a given issue.

Expand All @@ -71,7 +70,7 @@ common parameters in the order that they are found in health event logs.
|:--|:--|:--|
| status | Either `Healthy` or `Unhealthy` based on the event. | String |
| details | The details of the event include the type as `trackerId`, the `name` of the event, and a `description`. | JSON object of Strings |
| eventType | Health events have a value of `Health-Change`. | String |
| eventType | Account events have a value of `Health-Change`. | String |
| severityLevel | Either `Error` or `Warning` based on the event. | String |
| accountId | The unique identifier of the organization. | String |
| eventId | The unique identifier of the event. | String |
Expand Down Expand Up @@ -110,22 +109,22 @@ common parameters in the order that they are found in health event logs.
}
```

## Search health events
## Search Account events

To search all health events run a query against the internal partition
To search all account events run a query against the internal partition
named **sumologic_system_events**. For example,

```sql
_index=sumologic_system_events "Health-Change"
```

:::tip
Create a scheduled search to get alerts for specific health events.
Create a scheduled search to get alerts for specific account events.
:::

### Metadata assignment

Creating a query that defines built-in metadata field values in the scope can help improve search performance and limit results to what you're investigating. [Metadata](../search/get-started-with-search/search-basics/built-in-metadata.md) fields are assigned to health event logs as follows:
Creating a query that defines built-in metadata field values in the scope can help improve search performance and limit results to what you're investigating. [Metadata](../search/get-started-with-search/search-basics/built-in-metadata.md) fields are assigned to account event logs as follows:

| **Metadata Field** | **Assignment Description** |
|:--|:--|
Expand All @@ -139,9 +138,9 @@ A **Health** column on the Collection page shows color-coded healthy, error, a

The **status** column now shows the status of Sources manually paused by users.

![Collection health column.png](/img/health-events/Collection-health-column.png)
![Collection account column.png](/img/health-events/Collection-health-column.png)

* Hover your mouse over a Collector or Source to view a tooltip that provides the number of health events detected on the Collector or Source.
* Hover your mouse over a Collector or Source to view a tooltip that provides the number of account events detected on the Collector or Source.

![health tooltip.png](/img/health-events/health_tooltip.png)

Expand Down
2 changes: 1 addition & 1 deletion docs/manage/index.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,7 @@ This topic describes features and options that give you administration over acco
</div>
<div className="box smallbox card">
<div className="container">
<a href="/docs/manage/health-events"><img src={useBaseUrl('img/icons/business/user-permissions.png')} alt="icon" width="40"/><h4>Health Events</h4></a>
<a href="/docs/manage/account-events"><img src={useBaseUrl('img/icons/business/user-permissions.png')} alt="icon" width="40"/><h4>Account Events</h4></a>
<p>Monitor the health of your Collectors and Sources.</p>
</div>
</div>
Expand Down
6 changes: 3 additions & 3 deletions docs/manage/ingestion-volume/ingest-budgets/daily-volume.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -257,11 +257,11 @@ Search for only capacity usage logs:
_index=sumologic_audit _sourceName=VOLUME_QUOTA _sourceCategory=account_management "Budget" "last reset"
```

### Health events
### Account events

Health events allow you to keep track of the health of your Collectors, Sources, and Ingest Budgets. You can use them to find and investigate common errors and warnings that are known to cause collection issues. See [Health events](/docs/manage/health-events.md) for details.
Account events allow you to keep track of the health of your Collectors, Sources, and Ingest Budgets. You can use them to find and investigate common errors and warnings that are known to cause collection issues. See [Account events](/docs/manage/account-events.md) for details.

Ingest budgets that have exceeded their capacity are placed in an **Error** health state. The following are two common queries used to investigate the health of ingest budgets.
Ingest budgets that have exceeded their capacity are placed in an **Error** account state. The following are two common queries used to investigate the health of ingest budgets.

A query to search for all ingest budgets that are over capacity.

Expand Down
2 changes: 1 addition & 1 deletion docs/manage/manage-subscription/fedramp-capabilities.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -102,6 +102,6 @@ The following table shows the capabilities included with Sumo Logic’s FedRAMP
| Manage Data - Metrics | [Metrics Rules](/docs/metrics/metric-rules-editor/) |![check](/img/reuse/check.png)|![check](/img/reuse/check.png)|
| Manage Data - Metrics | [Metrics transformation rules](/docs/metrics/metrics-transformation-rules/) |![check](/img/reuse/check.png)|![check](/img/reuse/check.png)|
| Manage Data - Monitoring | [Connections](/docs/alerts/webhook-connections/) |![check](/img/reuse/check.png)|![check](/img/reuse/check.png)|
| Manage Data - Monitoring | [Health events](/docs/manage/health-events/) |![check](/img/reuse/check.png)|![check](/img/reuse/check.png)|
| Manage Data - Monitoring | [Account events](/docs/manage/account-events/) |![check](/img/reuse/check.png)|![check](/img/reuse/check.png)|
| Manage Data - Monitoring | [Monitors](/docs/alerts/monitors/) |![check](/img/reuse/check.png)|![check](/img/reuse/check.png)|
| Manage Data - Monitoring | [SLOs](/docs/observability/reliability-management-slo/) |![check](/img/reuse/check.png)|![check](/img/reuse/check.png)|
2 changes: 1 addition & 1 deletion docs/manage/security/audit-indexes/system-event-index.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -54,7 +54,7 @@ _index=sumologic_system_events _sourceCategory=alerts
| [Automation Service and Cloud SOAR](/docs/platform-services/automation-service/automation-service-audit-logging/) | `oar*` |
| [Cloud SIEM](/docs/cse/administration/cse-audit-logging/) | `cse*` |
| [Fields](/docs/manage/fields) | `fieldManagement` |
| [Health Events](/docs/manage/health-events/) | `Collection` |
| [Account Events](/docs/manage/account-events/) | `Collection` |
| [Monitors](/docs/alerts/monitors) | `monitors` |
| [Tracing Ingest](/docs/apm/traces/tracing-ingest) | `tracingIngest` |

Expand Down
2 changes: 1 addition & 1 deletion docs/metrics/introduction/metric-formats.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -97,7 +97,7 @@ cluster=cluster-1 node=node-1 cpu=cpu-1 metric=cpu_idle 97.29 1460061337

### Mandatory metric name

Unlike Prometheus, Carbon 2.0 format doesn't enforce the presence of a metric name. It also cannot be reliably inferred automatically. Therefore, Sumo Logic requires a `metric` key to be present among `intrinsic_tags`. All metrics without a `metric` key specified will not be ingested to Sumo Logic and a `MetricsMetricNameMissing` Health Event for the associated Metric Source will be triggered (for more information on Health Events, see [About Health Events](/docs/manage/health-events#health-events)).
Unlike Prometheus, Carbon 2.0 format doesn't enforce the presence of a metric name. It also cannot be reliably inferred automatically. Therefore, Sumo Logic requires a `metric` key to be present among `intrinsic_tags`. All metrics without a `metric` key specified will not be ingested to Sumo Logic and a `MetricsMetricNameMissing` Account Event for the associated Metric Source will be triggered (for more information on Account Events, see [About Account Events](/docs/manage/account-events#account-events)).

For example, the following metric will be correctly ingested to Sumo Logic:
```
Expand Down
Loading
Loading