It would be cool if Orion could do this. I know the SNMP Trap viewer does something like this. Is there a way to do this now or add it as a feature in a later release?
http://www.netcraftsmen.net/resources/technical-articles/712-syslog-summary-scripts.html
Tracking syslog events is very important in network operations. But the syslog stream at many sites is often chatty enough that a few important events may be easily overlooked. I became aware of a neat perl script that summarizes syslog through Phil Koontz. Phil found the neat script on the Internet, but doesn't recall where. Several people have done minor modifications to it over time, but it still has the original characteristics, which is to summarize the events of the day in a way that makes it easy to find key events. The script and supporting files may be downloaded from the links at the end of this page.
Below is an example of the syslog summary. The first section is the summary by message type. This is where you can find the low frequency, but critical message that tells you about impending disaster. An example is Pinnacle errors, which is an indication of an ASIC going bad on either the Supervisor module or on a line card in a Cisco Cat 6500. I have found power supply or fan problems here that other NMS systems failed to report. Also look at the few most common messages. The OSPF-5-ADJCHG messages are likely due to changes in the line protocol changes. Note that in the example there were two line protocol changes when a link went down and then back up. There were then nine corresponding OSPF adjacency changes, one for each line protocol transition.
The second section is the frequency, device and interface summary. This section tells you which devices and interfaces generated the counts that appear in the first section. A useful addition to the detail section would be the description on each interface that is reporting a problem. If you have good interface descriptions, this would help you quickly rank the importance of the interfaces without having to go elsewhere to look it up. Once you identify an important message, you'll need to go to the syslog logging file to see any additional messages that might be associated with the individual log messages. You may want to have this summary emailed to you daily, which is handy if you receive them on a smart phone and have the opportunity to scan them at your leisure.
