Syslog BGP Alerts and passing the syslog message to the alert manager

Hi,
I want to take action on receiving a syslog message related to BGP like the one below:

BGP Neighbor Change 8388903 myrouter: 8423202: May 28 17:03:53 UTC: %BGP-5-ADJCHANGE: neighbor 1.1.1.1 vpn vrf MY_VRF Down BGP Notification received

I have successfully created a custom rule in the log viewer:

but when this triggers the associated Alert in the alert manager, there doesn't seem to be any way to include the content of the actual syslog message (i.e. "%BGP-5-ADJCHANGE: neighbor 1.1.1.1 vpn vrf MY_VRF Down BGP Notification received") in any of the subsequent actions that I create for the alert. So my emails & workflows contain no context as to what neighbour in which VRF has gone down.

Has anyone succeeded in passing the actual syslog message through to the alert manager for further parsing?

NB. I have tried asking chatgpt and it refers me to non-existent namespaces or non-existent variables, so I've wasted a day on this already!

Thanks in advance!

Find more posts tagged with

syslog

how_to

bgp

Alerts

Accepted answers

All comments

chad.every

You can use this Alert Variable to see the full syslog message in your Alert Actions.

LogEntry Message: ${N=OLM.AlertingMacros;M=OLMAlertMessage.EventMessage}

Daran

I've already tried that one and it doesn't evaluate

vonzoom

It looks like you may be passing the '%' from the SYSLOG messages into the log and alert, and I'm wondering if that is the issue? I have basically the same setup and we get good messages passed across using the above noted variable.

Example code config in Alert (left) and Emailed message from event (right)

Daran

Thanks all - I raised a case with Support and they were able to resolve my issue. It looks like the alert variable that @chad.every mentioned does work after all. I tried it on numerous occasions and in various formats but it wasn't evaluating at all... see below (line above the circled text) as I am pretty sure the reference was correct:

but as you can see, it wasn't replacing the variable.

I got this comment from support which looks exactly the same to me:

I started again and used the same variable as suggested by support and now it works!