NPM Syslog rules actions

Allow more actions when creating rules without been obligated to create an alert. Not all syslog and traps require an alert. In my specific case, as a government entity I'm required to forward all syslog events to my cyber-security team.

@acook @aLTeReGo @jblank

Find more posts tagged with

syslog

npm

Status: None

Comments

p.darila

Could you please clarify a little bit more what exactly is missing?

Because, when you are in Log viewer and you want to create Log Processing Rule for Syslog messages, there is an "Forward the entry" action on Actions tab. So you can configure processing rule that will forward all syslog messages to another system without triggering orion alert.

Or are you missing some specific action from alerting that is missing in rule creation?

rodolfomanrique

Hello @p.darila

I just noticed the FORWARD THE ENTRY option is not showing for the Global Processing policies.

Create new rule under PROCESSING POLICIES > Global Processing. The action options are

RUN AN EXTERNAL PROGRAM
Execute a program or script.
FLAG FOR DISCARD
Rules will continue processing, but the entry will not be saved to the database.
STOP PROCESSING RULES
Halt further rule processing for the active log entry.

Then create a new rule under PROCESSING POLICIES > Syslog. The action options are

FORWARD THE ENTRY
Send the entry to another system for further processing.
RUN AN EXTERNAL PROGRAM
Execute a program or script.
FLAG FOR DISCARD
Rules will continue processing, but the entry will not be saved to the database.
STOP PROCESSING RULES
Halt further rule processing for the active log entry.

p.darila

Yes, "Forward the entry" is missing in global rules. It's because this action is supported only for syslogs and traps but is not supported for windows events, vmware events and log messages. Global rules are processing all message types.

Solution for your request is to create syslog specific rule for forwarding.