Syslog Viewer

I currently use a third party Syslog application and I had hopes that Orion's Syslog Viewer would be an improvement. It's close to what I need, but it's missing a couple things.

I have thousands of messages every day. I only care about a few, and of those I don't need to see every occurrence. The search feature is *exactly* what I'm looking for because it totals the messages instead of displaying them. The problem is, it can't be saved.

eg. I build tabs for BPDU errors, Interface flapping, TCAM threshold, etc. Then I close the app and they're all gone.

Please make the search tabs EDITABLE so they can be named, and SAVEABLE.

Find more posts tagged with

traps_summary_resource

orion_syslog

Accepted answers

All comments

FormerMember

Is this what you want?

Advanced Syslog Summary

Last 24 Hours

Change Period to: minute, hour, day, week, month, custom

MessageType	Severity	Who	Count
CRIT	Critical	who	2
SNMP-3-AUTHFAIL	Error	who	84
FAN-3-FAN_FAILED	Error	who	3071
FIB-4-FIBBADSNMPPREFIX	Warning	who	60
NTP-4-UNSYNC	Warning	who	1
LINK-4-ERROR	Warning	who	10

Traps Summary

Today

TrapType	Count
SNMPv2-MIB:authenticationFailure	646
BRIDGE-MIB:topologyChange	56
OSPF-MIB:ospfTraps.0.12	29
OSPF-MIB:ospfTraps.0.13	29
OSPF-MIB:ospfTrap.0.12	19
OSPF-MIB:ospfTraps.0.10	18
OSPF-MIB:ospfTrap.0.13	16
CISCO-ENTITY-ALARM-MIB:ciscoEntityAlarmMIBNotifications.1	7
CISCO-ENTITY-ALARM-MIB:ciscoEntityAlarmMIBNotifications.2	7
OSPF-MIB:ospfTrap.0.10	6
CISCO-PIM-MIB:ciscoPimMIBNotifications.3	2
ENTITY-MIB:entConfigChange	1
PIM-MIB:pimNeighborLoss	1

FormerMember

Where is that from? Helpful but not quite what I mean. It appears to show logs for *all* devices, I need it broken down by message/trap first, then by device.

For example, we watch for loops (kids do it all the time in classrooms). So I want to know if I have loops and where. Just knowing I have loops in the summary isn't enough because the summary could be showing loops I already have dispatched on. If the display shows the message/trap AND the device, as the Syslog Search feature does, then I have one screen that helps me identify problems AND shows me where they are happening.

646 auth failures on 1 device is much different than on 646 devices.

There are many messages/traps that I don't care about seeing on a daily basis, yet I still want them logged.

In addition the search tabs have an auto refresh so it's always current.

And I have tabs, so I can just click back and forth for different filters that I've already defined.

It is a little clunky because when I drill down on a device I loose the monitor tab that was refreshing my filter screen... I mean when I go back to it, that refresh interval has to be reset. But that could be fixed by my earlier request to allow the tab searches to be saved.

ecklerwr1

I would add your request to the NPM Feature Request Thread here:

http://thwack.com/forums/57.aspx

FormerMember

There are a bunch of resources you can add to views in NPM. Some per node some in general. There is also an advanced syslog parser resource you can play with.

You could also add rules to the syslog viewer to end you emails/pages, etc. I bet if you downloaded the free version of splunk and forwarded syslog to it from Orion, you could build exactly what you desire.