Enable alerts based on specific syslog ID

akanechan

Hi team,

NPM version 2024.2.0.

Trying to enable alert when BGP status changes on monitored Cisco FTD.

I've followed these but not getting any alerts, there is an out-of-box alert "BGP Neighbour Changed" but this isn't working either.

Do I need to assign devices that these alerts need to monitor?

How to create an effective, timely BGP neighbor status alert in NPM - Forum - Network Performance Monitor (NPM) - THWACK (solarwinds.com)

Create an alert when BGP route goes down or is missing in NPM (solarwinds.com)

I can see that Solarwinds is seeing syslog events when the BGP goes down/up, examples below.

%FTD-3-418018: neighbor 192.168.x.x Down

%FTD-3-418018: neighbor 192.168.x.x Up

So if I could add alerts based on the syslog ID AND with Down or Up in the message, it would work, but can't figure out how.

Any ideas?

For anyone out there with FTDs, I've added this to the platform settings after seeing the above events on Log Viewer but this has not made any difference.

 

Thanks,

akanechan

OK, so it seems I can create a rule from Log Viewer.

My understanding is "%FTD-3-418018" is an event data, rather than event ID, so I'd select If Event Data contain  "%FTD-3-418018" then with "AND" with either "Down" or "Up" conditions?

However, I don't understand what subfield is here? Do I just enter something meaningful to us, or something specific?