I have RTN working ok via the helpfile example, but I have an issue with syslogs. (forwarded syslogs)
It works ok if the device send syslongs to my ncm server (with syslog server running)
However due to the number of devices we have and traffic - they are all already setup to send to a central syslog server (unix, running syslog-ng)
We'd like to have the unix syslog server forward syslog messages to the ncm syslog server (so the 2 servers just talk, not hundreds of devices duplicating syslog messages to 2 servers)
Our Problem:
The first example below is how ncm syslog server sees a syslog message sent directly from a device
The second 2 examples below is how ncm syslog server sees a syslog message forwarded from the unix central syslog server (one by IP and one by hostname)
below that is the action (from the helpfile example) that executes on a config change. It uses the ${IP} variable from syslog to use to go get the current config to compare to the last downloaded config.
Problem is as you see, the forwarded syslog message from unix server sends the messages with its own hostname and IP appended, which the action script tries to use to go get the current config (from the unix server, not the device that sent the message)
We've researched this with syslog-ng and there are 2 options, keep_hostname (set in the syslog.conf file) and --spoof source (which has to be compiled into syslog-ng) that we thought would allow the forwarded message to retain the originating device hostname and IP. I think the --spoof source WOULD work, BUT:
The keep_hostname option did not work, and the Unix team is reluctant to recompile syslog-ng with the spoof source switch enabled. (due to other functions of that syslog server with other equipment)
As you can also see, the hostname of the originating device is the first "word" in the syslog message before the first "space" or ":" in the message.
Is there a way for the action script - rather than using ${IP} - to parse the {$message} string up to the first space OR ":" and use that to connect to to retrieve the latest config?
The help file only lists a handful of variables that are all preset so Im not sure if this is possible, if it is, it would help a lot for us and others with similar issues with syslog forwarding.
Examples below: from our ncm syslog server messages received
10.10.10.200 is the device switch1.domain.com
10.10.5.5 is the unix syslog-ng server (unixsyslog) that is forwarding syslog messages to our ncm syslog server
time/hostname/ip/severity/message
8/4/2011 1:29:52 PM 10.10.10.200 Notice 68: UTC: Configured from console by user1 on vty0 (x.x.x.x)
8/4/2011 1:33:45 PM unixsyslog 10.10.5.5 Notice 10.10.10.200: Aug 4 18:33:49 UTC: Configured from console by user1 on vty0 (x.x.x.x)
8/12/2011 10:56:59 AM unixsyslog 10.10.5.5 Debug switch1.domain.com /kernel: vlan MAC filter: xx:xx:xx:xx:xx:xx from port ge-3/0/17 rejected
action:
"D:\Program Files\SolarWinds\Configuration Management\ConfigAutoDownload.exe" ${IP},RealtimeNotification,${DateTime},${Message}
so in the first line above - it works correctly as the script autodownloads from 10.10.10.200 (value of {IP$}
but
in the second 2 examples, the script is trying to download from 10.10.5.5 or unixsyslog and thats wrong, but it WOULD work if the script could parse the message for the correct host or IP which IS included in the message itself
so I'd like to have the action do something like ConfigAutoDownload.exe (parse {$message} for first "word" up to the first occurrence of a "space" or ":" character) instead of {$IP}
do you have an example of how that could be done that I can use as my action script?
Im not sure if a regex would work or is allowed in the action script or not, and an example would be great - my regex skills are lacking 
Thanks!
