SysLog filtering

Sriram_1

Team,

I have BGP Down syslog and wanted to alert if the BGP Syslog message have %BGP-5-ADJCHANG and Down in the same message however it is not triggering alert to solarwinds alert engine ,can any one help me ,does the condition is correct to filter alert on same message and create a alert. do we have the filters in syslogs?

bourlis

Can I offer a different approach?  Since SYSLOG is UDT traffic its possible it can get dropped somewhere along the way or even by SW itself.  For that reason, I chose to go with monitoring BGP routing protocols via list resources.  I then implemented a custom property called 'BGPmonitor'.  After that it was a simple matter of creating the following alert:

I want to alert on - Routing Neighbors

Scope of alert - Routing Neighbors Protocol Name is equal to BPG and node custom property equal BGPmonitor.

Trigger condition - Routing Neighbors Protocol Status Description is not equal to Established.

With a rest condition of

I want to alert on - Routing Neighbors

Scope of alert - Routing Neighbors Protocol Name is equal to BPG and node custom property equal BGPmonitor.

Trigger condition - Routing Neighbors Protocol Status Description is equal to Established.

The network folks are happy with this alert as it gives them the option to easily add/remove nodes to the alert via the custom property and they say they don't get false positive alerts.