Data Lake status SNMP monitoring

Showing results for 
Show  only  | Search instead for 
Did you mean: 

Data Lake status SNMP monitoring

L2 Linker

Hi everybody,

we are quite often have a problem with logging to Data Lake.

Mostly Data Lake certificate expires and is not being renew automatically, so logs are not being forwarded to Data Lake and XDR doesn't have info. 

Is there a way, how to monitor certificate status, or dropped logs counters using snmp? (it is drop counter in command debug log-receiver rawlog_fwd_trial stats global show). Or any other way, for example raising an alarm etc.


Thank you,



Community Team Member

Hi @Jan_Linhart ,


There's only a limited set op counters that you can monitor with SNMP ... I don't think that the cert is part of it but it's worth a look :

SNMP Counter Monitoring 


Do you see anything in the system logs about the expired certificate ? If so you could create a mail alert based on those logs.




LIVEcommunity team member, CISSP
Please help out other users and “Accept as Solution” if a post helps solve your problem !

Read more about how and why to accept solutions.

Hi @kiwi ,

there are two ways, how to find out, that logs are not being sent to data lake (from the FW perspective)

1) check increasing drop counter for log forwarding (mentioned debug command)

2) check the reason - usualy expired certificate


There is no SNMP counter or log for the first one, so you have to do it manualy. You also cannot use API operational command call, because drop info is in debug command and there is no support for debug commands in API.


As a workaround, I've configured API call for certificate status (request logging-service certificate info) and than I parse XML output and look for string specific string. It is cumbersome, but better than nothing. Hope, that Data Lake monitoring will be added any time soon.


Thank you,




  • 2 replies
  • 101 Subscriptions
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!