New resources. Advanced syslog parser.

Gob

New! v.1.01
Advansed Syslog search, Syslog Parser like Cisco Works, Advanced Syslog Summary and Syslog Counts

Comments?

Find more posts tagged with

syslog

duration

custom_website_ideas

parser

resource

Accepted answers

All comments

jonchill

Gob

Looks good from the screen shot but I'm not sure where to place the files or where to put the block of code that you mention in the TXT I don't have an Orion foler off the Solarwinds Inetpub folder, do I have to creat the folder and legacy file?

Thanks

Jon

SamuelB

Comments?

This is great work Gob! I really like it. It is a bit rough around the edges, but it is something that I am able to take and get working easily.

Gob

Looks good from the screen shot but I'm not sure where to place the files or where to put the block of code that you mention in the TXT I don't have an Orion foler off the Solarwinds Inetpub folder, do I have to creat the folder and legacy file?

NO! You must find Your Oion website folder! By default c:\inetpub\solarwinds.
Then copy all files from "c--Inetpub--SolarWinds--netperfmon" folder into c:\inetpub\solarwinds\netperfmon\

Also copy all files "c--Inetpub--SolarWinds--NetPerfMon--Resources--1-1-SummaryReports" into c\Inetpub\SolarWinds\NetPerfMon\Resources\1-1-SummaryReports\
And from c--Inetpub--SolarWinds--Orion--NetPerfMon--Resources--Summary

Also You can edit "legacyProxy.config", by default it plased in c:\Inetpub\SolarWinds\Orion\
You must find Your Oion website folder!

SamuelB

NO! You must find Your Oion website folder!

I think it might help if you specify which version(s) this works with. I don't think the Orion folder appeared until lately (8.5 I think?). These resources work for me running Orion 8.5.1.

Gob

I think it might help if you specify which version(s) this works with. I don't think the Orion folder appeared until lately (8.5 I think?). These resources work for me running Orion 8.5.1.

Yes, of course. If SolarwindsNPM version 7.x please ignore readme.txt

P.S. I wrote search_syslog resource for version 7.x. It will be share later.

Mars

I have installed it and got great feedback from my (webconsole) users.
Thanks for the effort!!

Greetings,

Gob

Search Syslog Resource for OrionNPM v7.x

Malvado

This looks great, but I do get an error

SQL Open Error: Invalid column name 'access'.

I get this when I click on the 'who' link

Gob

[quote user="Malvado"]SQL Open Error: Invalid column name 'access'.
How to fix it.
1. Open syslog_who.asp in any text editor.
2. Find and delete ",nodes.access" in two places.

Before
SysLog.IP, Nodes.Caption, Nodes.NodeID,nodes.access, SysLog.MessageType,

After
SysLog.IP, Nodes.Caption, Nodes.NodeID, SysLog.MessageType,[/quote]

jonchill

Gob

That works a treat in v8.1.

Thanks

Jon

smcdonald

Nice!
I like it - a few minor issues I seem to be having -
The syslog search resource doesnt seem to work - I just get a blank IE page appear with no content at all - not even an error msg. I get the same when I try to use either the "msg" or "summ" links in Advanced Syslog Parser and also if I try to change the Time Period to minute/hour/day etc.

But the links to the servernames and the syslog message (where it displays as a number) works, as does the Advanced Syslog summary.

Any ideas?

Thanks for creating a great resource btw - very useful already!

BTW I'm running this on v8.5.1 SP2

Gob

Hi.
Have You Header in syslog_search_action.asp (Syslog search results for "traceback" pattern.)

Try to run it directly with your message pattern. Have You syslog messages with this pattern in selected period?
my_solarwinds_server/.../syslog_search_action.asp

Have You error 404 (The page cannot be found)?

>Try to view C:\Inetpub\SolarWinds\OrionWeb.log
Have You any error with my files? Access error? Not found error?

!!!! Have You table ACCESS in your NODES tables?

If You do not have ACCESS table You must remove "nodes.access" from any of my files!
Nodes.acces is an undocument feature

Try run sql query directly in ReportWriter or MS SQL Management Studio.

This source sql query from syslog_search_action.asp

SELECT SysLog.IP, Nodes.Caption, Nodes.NodeID,nodes.access, SysLog.MessageType,syslogseverity, COUNT(*) AS total
FROM SysLog inner JOIN Nodes on SysLog.IP=nodes.ip_address
--Add here your message pattern---------------
WHERE syslog.message like '%protocol%'
--Add here your period (minute,hour,day,week,month)---------------
and (SysLog.DateTime >dateadd(hour,-1,getdate()))

GROUP BY SysLog.IP, Nodes.Caption, Nodes.NodeID,nodes.access, SysLog.MessageType,SysLog.syslogseverity
order by total desc

This source from syslog_by_msg.asp

SELECT MessageType,syslogseverity, Count(*) As Total
,caption
, (select nodes.nodeID from nodes where nodes.ip_address='10.10.10.10') as NodeID
FROM SysLog left join nodes on (syslog.ip=nodes.ip_address)

Where (SysLog.DateTime >dateadd(day,-1,getdate()))
And (SysLog.IP='10.10.10.10')
AND(SysLog.Acknowledged=0)
GROUP BY MessageType,syslogseverity,caption Order By syslogseverity

This source sql query from syslog_parser_simple.asp

select caption,NodeID,IP, syslogseverity, cnt = count(*)
from syslog left join nodes on (nodes.ip_address=syslog.ip)
where ip='10.10.10.10' and
(SysLog.DateTime >(DateAdd(>hour,-1, GetDate())) )
group by caption,NodeID,IP, syslogseverity order by syslogseverity desc

Any results?

kulastone

Do i have to restart the Solarwinds Website after making these chances to see the outcome.. and it would all be visible under the syslog tab right..

Gob

Do i have to restart the Solarwinds Website after making these chances to see the outcome.. and it would all be visible under the syslog tab right..

No. No.

You do not need to restart Website, You just add a new resourses. See page 112 on OrionAdministratorGuide.pdf.

Point 5. If you want to add a resource, repeat the following steps for each resource
that you want to add:

Mars

Like i mentioned before our network pro's are enthusiastic about this feature.

They asked me if something similar is possible available with Traps (The parser).
Any suggestion for me in terms of already discussed or available.

Thanks in advance for info.

Gerjan

Gob

They asked me if something similar is possible available with Traps (The parser).

I will think about it.

Gob

Advanced syslog parser v.1.01 Small bugfix, added custom period for each resource, added SyslogMessagesRate chart.

aLTeReGo

I feel a little bit like an idiot, but I can't seem to find the Syslog Message Rate graph that you have pictured in your screenshot. Any idea what I might be doing wrong?

dave.woolterton

This looks great, but I am having trouble adding the SyslogMessagesRate Chart.

Any Ideas.

Thanks

kulastone

How do you add the search for syslog tab? i got everything else to work...

aLTeReGo

How do you add the search for syslog tab? i got everything else to work...

#1 Admin

#2 Customize Menu Bars

#3 Choose a Tool Bar to modify and click "Edit"

#4 Click the "+" to add a menu item

#5 At the bottom click "Add Custom Menu Item"

#6 In the "Name" field give your new menu bar option a name. e.g. (Syslog Summary)

#7 In the URL field enter the relative path to you new customized view. e.g. (/Orion/SummaryView.aspx?ViewID=##) Where ## is the ViewID of your custom view. This can usually be found by opening the custom view using the preview button.

#8 Click submit

kulastone

I dont see the search aspx anywhere.. i checked and i see it in the right folder.. cant put the url in until i find it... any ideas?

1.jpg

aLTeReGo

I dont see the search aspx anywhere.. i checked and i see it in the right folder.. cant put the url in until i find it... any ideas?

I apologize I gave you directions on how to add Syslog Summary to your menu bar. If you are looking for the syslog search "Add Resource" - "Summary Reports" - "Search for Syslog"

Search for Syslog.jpg

torrielw

I am unable to get the Syslog Message rate to display. It does not appear to be available in my web console.

sgreath

This is an awesome addition, great work!

I saw in one of your screen shots you had some options for how long each node/interface was down and summaries for each. I am not seeing those 4 options for some reason, everything else is working great though. Any idea what I missed?

swinds.JPG

Gob

This is an awesome addition, great work!

Thanks

I saw in one of your screen shots you had some options for how long each node/interface was down and summaries for each. I am not seeing those 4 options for some reason, everything else is working great though. Any idea what I missed?

It's a separate resource, I'll post it on a Monday. Today, You can use a previous version from here. You must use only this files

============================================

I am unable to get the Syslog Message rate to display. It does not appear to be available in my web console.

You must do the following steps.

1. Copy the Syslog-NetPerfMon.charts file intoc:\Program Files\Solarwinds\Orion

2. In Your console add a new resource. Admin--Customize views--select your Syslog parser page--Edit--click + (add new resources) , click+ on Network Wide Summary Charts, in expanded list select Custom Network Wide Chart, add

3. Preview, in Custom Network Wide Chart click Edit Resourse button. In expanded list select Syslog Messages rate

cooler0918

I have followed all of the steps above and I can't for the life of me get the syslog rate to show in the Custom Network Wide Chart drop down.

Justin.J

May Orion v9 sp1 use it?

AlbanyMike

Gob,.. you're custom works are incredible to say the least. However, I am having a problem with this one. I have created a new view called advanced Syslog. Under "Manage Views", I created this, and added the resource's that you described. (Advanced Syslog Summary, Syslog counts, Adv. Syslog Parser, etc.)

When I preview it,.. it looks great. I then go into Customize Menu Bars, and cannot find anything related to the syslog views I created?

I go to edit,.. add,... but I see nothing new?

Anyone else run into this?

AlbanyMike

IM getting this error:

any ideas,.. I am by no means a SQL guy.

System.Data.SqlClient.SqlException: Error converting data type varchar to numeric.
   at System.Data.SqlClient.SqlConnection.OnError(SqlException exception, Boolean breakConnection)
   at System.Data.SqlClient.SqlInternalConnection.OnError(SqlException exception, Boolean breakConnection)
   at System.Data.SqlClient.TdsParser.ThrowExceptionAndWarning(TdsParserStateObject stateObj)
   at System.Data.SqlClient.TdsParser.Run(RunBehavior runBehavior, SqlCommand cmdHandler, SqlDataReader dataStream, BulkCopySimpleResultSet bulkCopyHandler, TdsParserStateObject stateObj)
   at System.Data.SqlClient.SqlDataReader.HasMoreRows()
   at System.Data.SqlClient.SqlDataReader.ReadInternal(Boolean setTimeout)
   at System.Data.SqlClient.SqlDataReader.Read()
   at System.Data.Common.DataAdapter.FillLoadDataRow(SchemaMapping mapping)
   at System.Data.Common.DataAdapter.FillFromReader(DataSet dataset, DataTable datatable, String srcTable, DataReaderContainer dataReader, Int32 startRecord, Int32 maxRecords, DataColumn parentChapterColumn, Object parentChapterValue)
   at System.Data.Common.DataAdapter.Fill(DataTable[] dataTables, IDataReader dataReader, Int32 startRecord, Int32 maxRecords)
   at System.Data.Common.DbDataAdapter.FillInternal(DataSet dataset, DataTable[] datatables, Int32 startRecord, Int32 maxRecords, String srcTable, IDbCommand command, CommandBehavior behavior)
   at System.Data.Common.DbDataAdapter.Fill(DataTable[] dataTables, Int32 startRecord, Int32 maxRecords, IDbCommand command, CommandBehavior behavior)
   at System.Data.Common.DbDataAdapter.Fill(DataTable dataTable)
   at SolarWinds.Orion.Common.SqlHelper.ExecuteDataTable(SqlCommand command, DataTable dataTable)
   at SolarWinds.Orion.Common.SqlHelper.ExecuteDataTable(SqlCommand command)
   at SolarWinds.Orion.Web.Charting.NPMChartInfo.LoadData()
   at SolarWinds.Orion.Web.GraphResource.CreateChart(CustomPoller customPoller, String netObjectID, String chartName, Control parentControl)
   at SolarWinds.Orion.Web.SummaryGraphResource.CreateChart(String chartName, Control parentControl)
   at CustomNetworkChart.OnInit(EventArgs e)
   at System.Web.UI.Control.InitRecursive(Control namingContainer)
   at System.Web.UI.Control.AddedControl(Control control, Int32 index)
   at System.Web.UI.ControlCollection.Add(Control child)
   at Orion_ResourceContainer.ResourcePlaceHolder_DataBind(Object sender, EventArgs e)
   at System.Web.UI.Control.OnDataBinding(EventArgs e)
   at System.Web.UI.Control.DataBind(Boolean raiseOnDataBinding)
   at System.Web.UI.Control.DataBind()
   at System.Web.UI.Control.DataBindChildren()
   at System.Web.UI.Control.DataBind(Boolean raiseOnDataBinding)
   at System.Web.UI.Control.DataBind()
   at System.Web.UI.WebControls.Repeater.CreateItem(Int32 itemIndex, ListItemType itemType, Boolean dataBind, Object dataItem)
   at System.Web.UI.WebControls.Repeater.CreateControlHierarchy(Boolean useDataSource)
   at System.Web.UI.WebControls.Repeater.OnDataBinding(EventArgs e)
   at System.Web.UI.WebControls.Repeater.DataBind()
   at System.Web.UI.Control.DataBindChildren()
   at System.Web.UI.Control.DataBind(Boolean raiseOnDataBinding)
   at System.Web.UI.Control.DataBind()
   at System.Web.UI.Control.DataBindChildren()
   at System.Web.UI.Control.DataBind(Boolean raiseOnDataBinding)
   at System.Web.UI.Control.DataBind()
   at Orion_ResourceContainer.DataBind()
   at Orion_SummaryView.OnInit(EventArgs e)
   at System.Web.UI.Control.InitRecursive(Control namingContainer)
   at System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)

Gob

I go to edit,.. add,... but I see nothing new?

Yes,yes Click Preview and copy URL to clipboard. Then

admin
Customize Menu Bars
select your bar, e.g. "Admin Menu Bar" and click Edit
Click "+" (Add Menu Item)
Add Custom menu item
Add Name, Description and stored URL

URL must be without address and port e.g. /Orion/SummaryView.aspx?viewid=13

----------------------------------

Second question
You must redoanload and reinstall the Syslog-NetPerfMon.charts file. CRC32 of Syslog-NetPerfMon.charts must be 822DF7D4

AlbanyMike

Thanks for the tips!!! I copied the URL from my preview page, and pasted it into a custom menu bar and it now displays properly. It does not seem to be incimenting though. Everything is still all zeros, and we have had lots of syslog events in the meantime.

The chart is still an issue. I just downloaded your custom piece today, and you are saying I need to download it again to get Syslog-Netprfmon-charts?

This may be a stupid question,.. but how do I check the CRC32? I know crc is a redundancy check, but not sure where I would find that info?

Thanks again.

Impaler

I'm taking a look at installing this (v9.1 sp1) and have a couple of questions:

My NPM installation is not on the C:\ - is there code anywhere in here that uses that drive specifically?

Where should SearchSyslog.ascx go? The directory in the zip file says "c--Inetpub--SolarWinds--Orion--NetPerfMon--Resources--Summary" but I only see "SummaryReports" & "SummaryCharts" under "Resources".

thanks!!!

Gob

I dont know. But I think, that it does not matter. There a relative paths.
C:\Inetpub\SolarWinds\Orion\NetPerfMon\Resources\Summary

FormerMember

Hi, I copied the files to the respective locations but I'm having problems. I get the error SQL Open Error: Invalid column name 'access'. So I modified the syslog_who.asp file and removed 4 instances of nodes.access and I still get the error. I also don't see any graph either. Does anyone have any ideas?

thorpe

I have Orion version 9 and was trying to get this to work but having some problems. Does anyone have some detailed instructions on how to install?

on my page I get errors:

SQL Open Error: Invalid column name 'access'.

And all the colums say nothing, msg, summ and 0

Thanks for any help

Robert

Gob

my page I get errors:
SQL Open Error: Invalid column name 'access'.

Just create empty Access table.

Run Custom Property Editor. Then press Nodes,Add,Build a Custom Property from scratch, Add to Nodes, Name - Access, Type - text, length - 10
You can fill it later. SSH and Telnet url is very nice and useful feature!

FormerMember

Sweet, worked Great! Thank you very much!!!

thorpe

Well when I try and build the page and when I look at it this is what I am getting

Gob

Execute this query via ReportWriter

select syslogseverity, count(*)
from syslog
where (SysLog.DateTime >dateadd(month,-1,getdate()))
group by syslogseverity order by syslogseverity desc

Any results?

dclick

Well when I try and build the page and when I look at it this is what I am getting

I am also getting this. I ran this query:



 select syslogseverity, count(*)
from syslog
where (SysLog.DateTime >dateadd(month,-1,getdate()))
group by syslogseverity order by syslogseverity desc

and do get data returned. Could it be the way i have the view setup? I created a custom menu item, but used the link shown in the "Preview" window when i created the view space.

Short of this, EVERYTHING worked perfectly w/o a hitch, even the charts.

Thanks for an awsome addon!

cancermonitor

I am on 9.1 sp5 and my syslog chart works but the actual parser function does not show on the page. It worked fine for years until we had to do a new install and removed a piece of the program. Any ideas where where to start since I keep going down the wrong rabbit hole?

Thanks

bshopp

If you move to 9.5 we moved this functionality in out of the box. If you had this on 9.1, you will need to download the resource GOB wrote on the thwack context exchange

cancermonitor

Yeah I know about 9.5 and the functionality, I am looking forward to using it. The change in architecture caused a delay in our upgrade as we are on a shared SQL server and our DBAs could not give us the access we need. We should get our stand alone SQL server in August. This should help the response time of the program as well. I was just trying to find a work around until then. I will just keep hacking away til then.

Thank for the help.