Network devices etc. in an environment where we cannot monitor the interface due to license. We make alarms with syslog. When we do not create separate syslog alarms for each device and create alarms based on general vendor messages, we cannot perform a reset condition and we also create a clear alarm. In other words, we cannot make a reset condition for the syslog alarm that brings interface downs, because if one interface recovers and we send clear, the other one may be down. Is there any way we can get variables from syslog messages and make an alarm? If esxi4 is mentioned in the message that says interface down, if esxi4 interface up comes, reset it, but this esxi4 will be a variable, even if it comes for 5 or 6, to be able to handle this with a single alarm.
