Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

RESOLVED: Configure Alert Based on Syslog Entry

Hello.

My company currently has NPM, NTP & APM.

I'm wanting to create an alert that will trigger when an item is written to the Orion Syslog from one of our Cisco devices.

Here's some additional information:

We are running a Cisco ISR 3825.

We are logging the syslog items from the ISR into Solarwinds.

When we receive an event with the words "Duplicate address" we want to trigger an alert and then a subsequent notification.

Can anyone point me in the right direction?

Thanks.

Find more posts tagged with

Accepted answers

neilmborilla

1. Open Syslog Viewer

2. File > Setting > Alerts / Filter Rules

3. Add New Rule

4. Rule Name: <your preferred name ex. Alert for Duplicate address>

5. Message Tab

6. Message Pattern: type this = IP-4-DUPADDR

7. Then go to Alert Action Tab > Add New Action

8. Select Send an E-Mail / Page . Then configure it.( Assuming you already know how to do this part, if not let us know)

All comments

neilmborilla

1. Open Syslog Viewer

2. File > Setting > Alerts / Filter Rules

3. Add New Rule

4. Rule Name: <your preferred name ex. Alert for Duplicate address>

5. Message Tab

6. Message Pattern: type this = IP-4-DUPADDR

7. Then go to Alert Action Tab > Add New Action

8. Select Send an E-Mail / Page . Then configure it.( Assuming you already know how to do this part, if not let us know)

EarloftheWest

neilmborilla,

Thanks for your response.

In the Message tab, I see Message Type Pattern and Syslog Message Pattern. I'm guessing Syslog Message Pattern is the one I should use?

According to the examples in the Syslog Rule screen, I should type *Duplicate address*.

You have me typing = IP-4-DUPADDR. Is that an advanced message pattern string? If the words I'm looking for are "Duplicate Address", will the above string find them?

Thanks.

EarloftheWest

I called support on this question and they mentioned that typing *Duplicate address* was sufficient for what I want to do.

Consider this issue closed.