Alert Examples
The following examples are the types of alerts enStratus will produce as it monitors and manages cloud activities.
Lost Contact
This alert is sent when enStratus has lost contact with a server.
Date: Wed, 1 Dec 2010 17:50:14 +0000 (UTC)
From: alerts@enstratus.com
To: greg.moselle@enstratus.com
Subject: OUTAGE #14819 DISCOVERED (Severity 5) - No Contact: i-ex7d28c5/Amazon Web Services - Company Inc - 17:50:14 UTC Cloud: Amazon Web
enStratus has lost the ability (available). i-ae7d28c3 New Outage #14819: Wed 01 Dec 2010 Services Account: Company Inc to ping i-ex7d28c5 in N. Virginia (us-east-1)
You will receive this alert if server, but is no longer able to ping it. enStratus makes sure that ICMP packets can traverse the network elements it controls, but you should verify that you have not put in place anything that would prevent enStratus from pinging your server.
If you need assistance understanding this message or if you believe this message is the result of an issue with enStratus, please visit our support site at https://support.enstratus.com and login with your standard enStratus login credentials.
To check on the status of enStratus itself, visit: http://status.enstratus.com Subscribe to live status updates via RSS at http://status.enstratus.com/status.xml or via Twitter at http://www.twitter.com/enStratusStatus.
Firewall Change
This alert is sent when there is a modification made to a firewall.
New Cloud Event: Thu 13 Jan 2011 17:10:07 UTC
Cloud: Amazon Web Services
Account: Company Subject: NEW EVENT #340176 (Severity 5) - Firewall Rule ADDED to Amazon Web Services/Company/default [default]
A new firewall rule has been added to the firewall default #6979 [default].
Agent: Provider ID: Type: CIDR: Protocol: Start Port: End Port: Permission: External default:999.999.177.183/32:INGRESS:TCP:2003:2003 INGRESS 999.999.177.183/32 TCP 2003 2003 ALLOW enStratus had previously successfully pinged the If this rule change was not authorized, you should take immediate action to address the situation.
If you need assistance understanding this message or if you believe this message is the result of an issue with enStratus, please visit our support site at https://support.enstratus.com and login with your standard enStratus login credentials.
To check on the status of enStratus itself, visit: http://status.enstratus.com
Subscribe to live status updates via RSS at http://status.enstratus.com/status.xml or via Twitter at http://www.twitter.com/enStratusStatus.
Outrage Ends via Termination
This alert is sent when a server has been experiencing an outage but has since been terminated.
Date: Wed, 1 Dec 2010 17:50:54 +0000 (UTC)
From: alerts@enstratus.com
To: greg.moselle@enstratus.com
Subject: OUTAGE #14819 CLEARED (Severity 5) - Outage Ends via Termination Ongoing Outage #14819: Wed 01 Dec 2010 17:50:54 UTC Cloud: Amazon Web Services
Account: Company
i-ae4d2lc8 is no longer experiencing an outage as it has been terminated.
If you need assistance understanding this message or if you believe this message is the result of an issue with enStratus, please visit our support site at https://support.enstratus.com and login with your standard enStratus login credentials.
To check on the status of enStratus itself, visit: http://status.enstratus.com
Subscribe to live status updates via RSS at http://status.enstratus.com/status.xml or via Twitter at http://www.twitter.com/enStratusStatus.
Server Terminated
This alert is sent when a server is terminated for a known reason.
Date: Wed, 1 Dec 2010 19:28:27 +0000 (UTC)
From: alerts@enstratus.com
To: greg.moselle@enstratus.com
New Cloud Event: Wed 01 Dec 2010 19:28:27 UTC
Cloud: Amazon Web Services
Account: Company Name
Subject: NEW EVENT #312441 (Severity 2) - Server Terminated
The server Windows2003-IIS6-independent-node-1-(replacement-2010121-1641) (#25988) was terminated by request of Erik Johnson (p441).
testing auto-recovery
If you need assistance understanding this message or if you believe this message is the result of an issue with enStratus, please visit our support site at https://support.enstratus.com and login with your standard enStratus login credentials.
To check on the status of enStratus itself, visit: http://status.enstratus.com
Subscribe to live status updates via RSS at http://status.enstratus.com/status.xml or via Twitter at http://www.twitter.com/enStratusStatus.
Unauthorized Web Scan
This alert has to do with an unathorized web scan happening on a server.
Date: Wed, 1 Dec 2010 06:14:31 +0000 (UTC)
From: alerts@enstratus.com
To: greg.moselle@enstratus.com
New Cloud Event: Wed 01 Dec 2010 06:14:31 UTC
Cloud: Amazon Web Services
Account: Company
Subject: NEW EVENT #312184 (Severity 5) - IDS ALERT: ’Multiple attempts to access non-existent files (web scan) from same source.’: app-server-1/Amazon Web Services - Company - i-55555558
Intrusion Detection System Alert (Severity 5) Wed Dec 01 06:14:24 UTC 2010
CLOUD: Amazon Web Services
SERVER ID: 25744
NAME: app-server-1
SUBJECT: from same source.’ ALERT: IDS ALERT: ’Multiple attempts to access non-existent files (web scan)
2010 Dec 01 06:14:24 app-server-1->/var/log/apache2/error.log
Rule: 30114 (level 10) -> ’Multiple attempts to access non-existent files (web scan) from same source.’
Src IP: 999.999.30.105
User: (none)
[Wed Dec 01 06:14:24 2010] [error] [client 999.999.30.105]
File does not exist: /var/www/p
[Wed Dec 01 06:14:23 2010] [error] [client 999.999.30.105]
File does not exist: /var/www/mysqlmanager
[Wed Dec 01 06:14:23 2010] [error] [client 999.999.30.105]
File does not exist: /var/www/sqlmanager
[Wed Dec 01 06:14:23 2010] [error] [client 999.999.30.105]
File does not exist: /var/www/pma2006
[Wed Dec 01 06:14:23 2010] [error] [client 999.999.30.105]
File does not exist: /var/www/PMA2006
[Wed Dec 01 06:14:22 2010] [error] [client File does not exist: /var/www/dbadmin
[Wed Dec 01 06:14:22 2010] [error] [client 999.999.30.105]
File does not exist: /var/www/admin
[Wed Dec 01 06:14:22 2010] [error] [client 999.999.30.105]
File does not exist: /var/www/PMA [Wed Dec 01 06:14:21 2010] [error] [client File does not exist: /var/www/web
[Wed Dec 01 06:14:21 2010] [error] [client 999.999.30.105]
File does not exist: /var/www/db
[Wed Dec 01 06:14:21 2010] [error] [client 999.999.30.105]
File does not exist: /var/www/phpMyAdmin
If you need assistance understanding this message or if you believe this message is the result of an issue with enStratus, please visit our support site at https://support.enstratus.com and login with your standard enStratus login credentials.
To check on the status of enStratus itself, visit: http://status.enstratus.com
Subscribe to live status updates via RSS at http://status.enstratus.com/status.xml or via Twitter at http://www.twitter.com/enStratusStatus.
Soft Run Rate Exceeded
This alert is sent when the monthly soft run rate has been exceeded.
New Cloud Event: Wed 01 Dec 2010 02:59:41 UTC
Cloud: Amazon Web Services
Account: Company Name
Subject: NEW EVENT #312218 (Severity 5) - Monthly Soft Run-Rate Exceeded for
Company Company Name (YACNGT)
The current run-rate of usage against the billing code Company Company Name (YACNGT) exceeds the alloted soft run rate for this budget.
If you need assistance understanding this message or if you believe this message is the result of an issue with enStratus, please visit our support site at https://support.enstratus.com and login with your standard enStratus login credentials.
To check on the status of enStratus itself, visit: http://status.enstratus.com
Subscribe to live status updates via RSS at http://status.enstratus.com/status.xml or via Twitter at http://www.twitter.com/enStratusStatus.
Soft Run Rate Exceeded
This alert is sent when the monthly soft run rate has been exceeded.
New Cloud Event: Wed 01 Dec 2010 02:59:41 UTC
Cloud: Amazon Web Services
Account: Company Name
Subject: NEW EVENT #312218 (Severity 5) - Monthly Soft Run-Rate Exceeded for Company Company Name (YACNGT)
The current run-rate of usage against the billing code Company Company Name (YACNGT) exceeds the alloted soft run rate for this budget.
If you need assistance understanding this message or if you believe this message is the result of an issue with enStratus, please visit our support site at https://support.enstratus.com and login with your standard enStratus login credentials.
To check on the status of enStratus itself, visit: http://status.enstratus.com
Subscribe to live status updates via RSS at http://status.enstratus.com/status.xml or via Twitter at http://www.twitter.com/enStratusStatus.
Soft Run Rate Okay
This alert is sent when the monthly soft run rate has returned below the soft quota.
Date: Wed, 1 Dec 2010 03:21:50 +0000 (UTC)
From: alerts@enstratus.com
To: greg.moselle@enstratus.com
New Cloud Event: Wed 01 Dec 2010 03:21:50 UTC
Cloud: Amazon Web Services
Account: Company
Subject: NEW EVENT #312221 (Severity 5) - Monthly RunRate Now within Soft Limits for Company Name (YACNGH)
The budget status for Company Name (YACNGH) is again within normal parameters.
If you need assistance understanding this message or if you believe this message is the result of an issue with enStratus, please visit our support site at https://support.enstratus.com and login with your standard enStratus login credentials.
To check on the status of enStratus itself, visit: http://status.enstratus.com
Subscribe to live status updates via RSS at http://status.enstratus.com/status.xml or via Twitter at http://www.twitter.com/enStratusStatus.
Hard Run Rate Exceeded
This alert is sent when the monthly soft run rate has been exceeded.
New Cloud Event: Wed 01 Dec 2010 02:11:15 UTC
Cloud: Amazon Web Services
Account: Company Name
Subject: NEW EVENT #312214 (Severity 7) - Monthly Hard Run-Rate Exceeded for Website (WWW)
The current run-rate of usage against the billing code Website (WWW) exceeds the alloted hard run rate for this budget. As a result, no one will be able to provision resources against this budget until the run-rate falls within the hard quota. You may remedy the situation either by increasing the hard quota for this budget or reducing the current spend against the budget.
If you need assistance understanding this message or if you believe this message is the result of an issue with enStratus, please visit our support site at https://support.enstratus.com and login with your standard enStratus login credentials.
To check on the status of enStratus itself, visit: http://status.enstratus.com
Subscribe to live status updates via RSS at http://status.enstratus.com/status.xml or via Twitter at http://www.twitter.com/enStratusStatus.
Hard Run Rate Okay
This alert is sent when the monthly hard run rate has returned below the hard quota.
Date: Wed, 1 Dec 2010 04:11:32 +0000 (UTC)
From: alerts@enstratus.com
To: greg.moselle@enstratus.com
New Cloud Event: Wed 01 Dec 2010 04:11:32 UTC
Cloud: Amazon Web Services
Account: Company Name
Subject: NEW EVENT #312224 (Severity 6) - Monthly Run-Rate Now within Hard Limits for Website (WWW)
Your run-rate for Website (WWW) is now within the hard limits, but is still exceeding the soft quota. You should be able to provision resources against this budget again, but you should be careful about your usage.
If you need assistance understanding this message or if you believe this message is the result of an issue with enStratus, please visit our support site at https://support.enstratus.com and login with your standard enStratus login credentials.
To check on the status of enStratus itself, visit: http://status.enstratus.com
Subscribe to live status updates via RSS at http://status.enstratus.com/status.xml or via Twitter at http://www.twitter.com/enStratusStatus.
Backup Datasource Success
This alert is sent following a successful call to the backupDataSource script.
Date: Wed, 1 Dec 2010 06:48:43 +0000 (UTC)
From: alerts@enstratus.com
To: greg.moselle@enstratus.com
New Cloud Event: Wed 01 Dec 2010 06:48:43 UTC Cloud: Amazon Web Services
Account: Company
Subject: NEW EVENT #312242 (Severity 4) - Data Source Backup Success: Amazon Web Services - Company - company_product
enStratus was again able to execute a data source backup for the data source company_product on the database mysql.
If you need assistance understanding this message or if you believe this message is the result of an issue with enStratus, please visit our support site at https://support.enstratus.com and login with your standard enStratus login credentials.
To check on the status of enStratus itself, visit: http://status.enstratus.com
Subscribe to live status updates via RSS at http://status.enstratus.com/status.xml or via Twitter at http://www.twitter.com/enStratusStatus.
Excessive OSSEC Events
This alert is sent when there have been excessive OSSEC events.
Date: Wed, 1 Dec 2010 03:00:21 +0000 (UTC)
From: alerts@enstratus.com
To: greg.moselle@enstratus.com
New Cloud Event: Wed 01 Dec 2010 03:00:21 UTC Cloud: Amazon Web Services
Account: Company
Subject: NEW EVENT #312159 (Severity 4) - IDS ALERT: ’Excessive number of events (above normal).’: prd-2-cache/Amazon Web Services - Company - i-aeb2a8c6
Intrusion Detection System Alert (Severity 4) Wed Dec 01 02:59:55 UTC 2010
CLOUD: Amazon Web Services
SERVER ID: 3623
NAME: prd-2-cache
SUBJECT: IDS ALERT: ’Excessive number of events (above normal).’
2010 Dec 01 02:59:55 prd-2-cache->/var/log/apache2/access.log Rule: 11 (level 8) -> ’Excessive number of events (above normal).’ Src IP: 10.243.47.96 User: (none) The average number of logs between 2:00 and 3:00 is 19104. We reached 24837.
If you need assistance understanding this message or if you believe this message is the result of an issue with enStratus, please visit our support site at https://support.enstratus.com and login with your standard enStratus login credentials.
To check on the status of enStratus itself, visit: http://status.enstratus.com
Subscribe to live status updates via RSS at http://status.enstratus.com/status.xml or via Twitter at http://www.twitter.com/enStratusStatus.
Snapshot Failure
This alert is sent when enStratus has failed to perform an automated snapshot.
Date: Wed, 1 Dec 2010 05:44:11 +0000 (UTC)
From: alerts@enstratus.com
To: greg.moselle@enstratus.com
New Cloud Event: Wed 01 Dec 2010 05:44:11 UTC
Cloud: Amazon Web Services
Account: Company Name
Subject: NEW EVENT #312232 (Severity 4) - Snapshot Backup Failure: Amazon Web Services - Company Name
Snapshot Failure: Wed Dec 01 05:44:01 UTC 2010 Production 2 Applications 1 - 919
enStratus failed to create a snapshot of any server in the server group Production 2 Applications 1 in the cluster Production 2.
Reason for failure: Error writing to XMLStreamWriter.
If you need assistance understanding this message or if you believe this message is the result of an issue with enStratus, please visit our support site at https://support.enstratus.com and login with your standard enStratus login credentials.
To check on the status of enStratus itself, visit: http://status.enstratus.com
Subscribe to live status updates via RSS at http://status.enstratus.com/status.xml or via Twitter at http://www.twitter.com/enStratusStatus.
Trojaned Netstat
This alert is sent when OSSEC thinks there is a trojaned version of netstat on the sytem.
Date: Wed, 1 Dec 2010 08:12:40 +0000 (UTC)
From: alerts@enstratus.com
To: greg.moselle@enstratus.com
New Cloud Event: Wed 01 Dec 2010 08:12:40 UTC
Cloud: Amazon Web Services
Account: Company Name
Subject: NEW EVENT #312317 (Severity 3) - IDS ALERT: ’Host-based anomaly detection event (rootcheck).’: prd-2-app-1/Amazon Web Services - Company Name - i-60555555
Intrusion Detection System Alert (Severity 3) Wed Dec 01 08:12:11 UTC 2010
Cloud: Amazon Web Services
Server ID: 2340
Name: prd-2-app-1
Subject: IDS ALERT: ’Host-based anomaly detection event (rootcheck).’
2010 Dec 01 02:12:10 prd-2-app-1->rootcheck
Rule: 510 (level 7) -> ’Host-based anomaly detection event (rootcheck).’
Src IP: (none)
User: (none)
Port ’54579’(tcp) hidden. Kernel-level rootkit or trojaned version of netstat.
If you need assistance understanding this message or if you believe this message is the result of an issue with enStratus, please visit our support site at https://support.enstratus.com and login with your standard enStratus login credentials.
To check on the status of enStratus itself, visit: http://status.enstratus.com
Subscribe to live status updates via RSS at http://status.enstratus.com/status.xml or via Twitter at http://www.twitter.com/enStratusStatus.
Unexpected Pause
This alert is sent when a server has been unexpectedly paused.
Date: Thu, 9 Dec 2010 19:49:59 +0000 (UTC)
From: alerts@enstratus.com
To: greg.moselle@enstratus.com
New Cloud Event: Thu 09 Dec 2010 19:49:59 UTC
Cloud: Amazon Web Services
Account: Company Name
Subject: NEW EVENT #317021 (Severity 5) - Unexpected Server Pause
The server TestingMount (#26076) paused unexpectedly. A number of factors may cause this to happen:* The server was paused through a means other than the enStratus Console * A problem with the operating system caused the server to shutdown unexpectedly and not restart * An underlying issue with the cloud provider
If you need assistance understanding this message or if you believe this message is the result of an issue with enStratus, please visit our support site at https://support.enstratus.com and login with your standard enStratus login credentials.
To check on the status of enStratus itself, visit: http://status.enstratus.com
Subscribe to live status updates via RSS at http://status.enstratus.com/status.xml or via Twitter at http://www.twitter.com/enStratusStatus.
Updated: 08-01-2011: