Real Time Change Detection - Syslog/Trap

Hello,

I am creating this feature because of experience and Client feedback when we tried to enable Syslog generated Real Time Change Detection (RTCD) when receiving a Syslog message from an IP Address other than the Managed Nodes IP Address. This particular instance we could get Syslog from many other IP Addresses, than you could see using the IP address resource on the Node Details page, however none of them could/would kick-off the RTCD process. We were unable to get the device to send the Syslog using the Mgmt Interface. As, Orion already knows all associated IP address, please allow the Syslog Engine to associate a message from and IP to the Node being Managed, so that it then can trigger other actions like RTCD.

Best Regards,

Derik Pfeffer

Loop1 Systems: SolarWinds Training and Professional Services

LinkedIN: Loop1 Systems
Facebook: Loop1 Systems
Twitter: @Loop1Systems

Find more posts tagged with

syslog

ncm_rtcd_alerts

ncm

Status: None

Comments

clubjuggle

This should be resolvable in the client's device configuration by adding the logging source-interface ifname command in the target device's global configuration (or equivalent command if it's a non-Cisco device), where ifname is the name of the interface with the management address. This will cause all Syslog traffic from the device to be originated with the IP address of the chosen interface.

derik.pfeffer

clubjuggle,

Thanks for this, however due to the Client Configurations (VRFs) and routing, the Cisco devices couldn't be configured to use the Mgmt interface as a source. The Client had tried several commands to make this happen with no success. This feature would allow Client's to avoid trying to make things work, if the Syslog engine could leverage the information already in Orion to correlate like NTA does now. This use to be a major issue in NTA that is now resolved.

Best Regards,

Derik Pfeffer

Loop1 Systems: SolarWinds Training and Professional Services

LinkedIN: Loop1 Systems
Facebook: Loop1 Systems
Twitter: @Loop1Systems

tony.johnson

Hey Derek,

Great Idea! +1 here!

In the mean time,

Have you considered using an advanced query to retrieve the polling IP address for the source of the Syslog message and using this to call the RTNForwarder.exe?

If Orion is listing all the IP's on the node then we could look to NodeIPAddresses table for the nodeId and use this to find the Polling IP from the Nodes table.

Something Similar to this should work in the alert action

Instead of Looking at the ${IP_Address}

C:\Program Files (x86)\SolarWinds\Orion\SolarWinds.NCM.RTNForwarder.exe ${IP_Address},RealtimeNotification,${DateTime},${Message}

We substitute it with a query to find the PollingIP

C:\Program Files (x86)\SolarWinds\Orion\SolarWinds.NCM.RTNForwarder.exe ${SQL:SELECT IPaddress FROM Orion.Nodes where nodeid = (select distinct(nodeid) from Orion.NodeIPAddresses where IPAddress=${IP})},RealtimeNotification,${DateTime},${Message}

Hope that helps,

Thanks,

TonyJohnson

Sales Engineer - Solarwinds

familyofcrowes

I agree.

We use LEM and I would like to see LEM be able to tell NCM to kick off a backup (RTCN) hence eliminating the need to send syslogs to Orion, saving resources....

ncmuser2015

Tony,

We are experiencing a similar issue and need to use the non-polling addresses as the source IP from syslog. I've tried the workaround you suggested, but haven't been able to get it to work.

We are using NCM 7.4, so I've made a few tweaks, but I have it working all the way down to the ${IP_Address} variable. If I hard-code the non-polling address, I receive the notification, but when using the variable, it returns "{MACRO}" in the log file.

C:\Program Files (x86)\SolarWinds\Orion\SolarWinds.NCM.RTNForwarder.exe ${SQL:SELECT IP_address FROM NodesData where nodeid = (select distinct(nodeid) from NodeIPAddresses where IPAddress=${IP_Address})},RealtimeNotification,${DateTime},${Message}

Any assistance would be greatly appreciated.

Thanks,

Brian