Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

SYS LOG issues in NPM

Help,

Problems with SYS LOG. I am working on my sys log server in NPM. I am filtering out the messages I do not want to see and it works fine. However when I want to page or send me and email from certain alerts, the filtering all goes down the tubes and I get emails on everything. Than to make matter stranger, I can disable the rule that is supposed to email me and I still keep getting the mail or sms text messages!! I have to delete the rule for this to stop. Running V8 with hotfix3, any ideas?

Thanks for any help,

SPDD3MN

Find more posts tagged with

Accepted answers

All comments

jtimes

Can you post the rule definition?

You might want to look at the Trigger Thresholds and make sure you check the "Suspend further Alert Action" button.

spdd3mn

The filter rule looks as follows

*LINK-3-UPDOWN*
*SNMP-3-AUTHFAIL*
*socket overflow from Source*
*PERIODIC_INVENTORY*
*TCP_MAXESTABLISHED*
*DAEMON-3-SYSTEM_MSG:*
*RSCN-2-RSCN_REJECT:*
*SYSMGR-3-SERVICE_CRASHED*
*SYS-2-FAN*
*DOT11-6-ASSOC*
*LINEPROTO-5-UPDOWN*
*Interface Dot11Radio0*
*IGMP: Rcvd Leave*

and it is discarding the above messages if they come under (error, warning, notice, informational, or debug) Severity.

Now I want to send us en email for (Emergency, Alert, Critical,Error, or Warning) Severity for all other messages so I just use the * wild card under the notify rule messages. I assume what is happening is it is hitting the wild card and emailing me, however I have the filter above this rule. Do the filters work like ACL's ? I thought I read they do somewhere... if they do not than would I have to do an inclusion rule on all the message I want to be paged ON? That does not seem to make sense so I have to figure out what I am doing wrong.

Sorry used to KIWI so it is a little different...first time trying to migrate to SW SYS Log so please forgive me if I am missing something really obvious. Documentation on SYS LOG and SW is very sketchy.

spdd3mn

also another question I have,

Is anyone else using the SYS LOG and monitoring switchports that are uplinks, trunks? MAN L2 connectivity ports, such as gigaman? If so how are you monitoring the specifc ports without getting all the ports that go up and down on a switch?

jtimes

Okay, the * is what is causing it to go berzerker... Start by viewing the active syslog messages and find one that you want a email for, then define a rule specifically for it. Here is an example of one that shows duplicate IP addresses.

The IP address in a GLBP message received on the interface is the same as the IP address of the router. This condition might be due to a misconfiguration or a malfunctioning switch.

Rule Name: %GLBP-4-DUPADDR:

Syslog Message Pattern: *%GLBP-4-DUPADDR:*

Trigger Threshold: (check the box next to ) Define a Trigger Threshold for this rule

Suppress Alert Actions until at least 1 Syslog messages matching this rule

are received in a 1 minute time window

(check the box next to) Suspend further Alert Actions for XXX seconds after the Alert Actions are executed

You can also create one rule for each type of Message Severity, but don't forget under the Trigger Threshold tab: (check the box next to ) Define a Trigger Threshold for this rule, and to also (check the box next to) Suspend further Alert Actions for XXX seconds after the Alert Actions are executed.

Don't try to lump them all together, take it in small steps and keep each rule as simple as possible.

spdd3mn

what's really funny is I was trying to get it working and now I have even deleted the rule for the email and the mail will not stop.... this part looks like a bug...

So the other part is I obviously have to do "inclusion" rules. But problem with that is there maybe messages I will want that I do not know about. Say I get a module disabled sys log message but I didn't know that you could even specfiy this message or it even existed. That is a problem....basiclly it is like a firewall rule set...if it is not implicitly allowed it is explicitly denied?

shoot I can't get this thing to stop emailing me and rule is deleted even...they are coming so fast it is bogging down laptop now....

jtimes

also another question I have,

Is anyone else using the SYS LOG and monitoring switchports that are uplinks, trunks? MAN L2 connectivity ports, such as gigaman? If so how are you monitoring the specifc ports without getting all the ports that go up and down on a switch?

We don't use Syslog messages for monitoring uplinks, we use Basic Alerts and Advanced Alerts in Orion. It can be done with Syslog, but if the issue is on the far side of the connection, then you might not get a Syslog message, because the link is down.