Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials

NPM send to Syslog action : Advance vs Basic Alerts.

I am trying to move all my alerts to the Advance Alert system but I have minor issue when sending Syslog messages. When using Adv. Alert a timestamp is added to the messgae.

May-12-2010 10:17 : Alert: ######### has exceptionaly high response time. AverageResponse Time is 231 ms and is varying from 4 ms to 878 ms.

While syslog messages from Basic Alerts show up like this;

Alert: ######### has exceptionaly high response time. Average Response Time is 231ms and is varying from 4 ms to 878 ms.

Is there a way to strip the Syslog timestamp in Adv. Alert messages ?

Find more posts tagged with

Accepted answers

PetrKnyttl

Got it. So, key is to use Run Script action in the Syslog server, but you'll have to modify your Syslog Message in the Advanced Alert.

1. Copy the code below into text file and save it so Syslog server can reach it
2. Go to Syslog server, go to Setup. Create Action "Run Script".
3. Set up this action to use the file from the step 1; set the Script Language to "VBScript". Adjust the Read/Write permissions: both "Common Fields" and "Other Fields" set to Read and Write.
4. Set up additional actions as you want, but the Run Script should be the first one
5. Go to Alert Manager, modify the Advanced Alert and it's Trigger Action.
6. In the Send Syslog Message set the IP Address of Syslog Server and Syslog message. And here's the biggest trick: use "##" on the beginning of the Syslog Message.

Script will search for these chars and remove all before those ## and removes these characters as well. This should give you possibility to use the same script in the future without modifications, just put ## what you want to keep.

I suggest to use Syslog Message Generator before you'll modify your alerts so these won't interfere with your production environment.

Code to use:

Function Main()

msg = Fields.VarCleanMessageText
startPos = InStr(msg, "##")
'do we have a match
If startPos > 0 Then
Fields.VarCleanMessageText = Right(msg, Len(msg) - startPos - 1)
End If

Main = "OK"
End Function

Capture.PNG

All comments

PetrKnyttl

wjcmalana, where do you see this message? I can't see any timestamp on the website or Alert Manager or Syslog Viewe, no matter what I try.

wjcmalana

Sorry for missing the most important info

I do not use Orion's builtin Syslog server. I use Kiwi (thankfully an SW product now) for my Syslog.

PetrKnyttl

Got it. So, key is to use Run Script action in the Syslog server, but you'll have to modify your Syslog Message in the Advanced Alert.

I suggest to use Syslog Message Generator before you'll modify your alerts so these won't interfere with your production environment.

Code to use:

Function Main()

msg = Fields.VarCleanMessageText
startPos = InStr(msg, "##")
'do we have a match
If startPos > 0 Then
Fields.VarCleanMessageText = Right(msg, Len(msg) - startPos - 1)
End If

Main = "OK"
End Function

Capture.PNG

wjcmalana

Thanks alot.