Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials

Syslog rules gone

I upgraded to 12.5 last week and I just discovered that Syslog Viewer is gone. Okay, fine - it wasn't clear or I missed the part during the upgrade that detailed all of this. I then noticed that there are no more syslog rules set up to forward my syslogs to email, which is something we used extensively. I see that this is appears to be possible with the new syslog alert engine, but my question is, do I seriously need to go through, one by one, to reconfigure all my rules by reading them in the database? Also, is alerting based on MessageType *really* not an option anymore?

Find more posts tagged with

Accepted answers

All comments

sum_giais

Unfortunately there’s no migration path much like upgrading to the newer versions of NTA. Worth asking support as this may have changed you never know but here’s the feature comparison of the legacy syslog/trap to the new LA/OLV. It still notes that filtering by message type isn’t supported.

If you go to create a rule does the option message type show up in the conditions at all for you?

https://documentation.solarwinds.com/en/Success_Center/LA/Content/LA/LA-Syslog-Trap-Parity.htm

bleearg13

No, it does not. I'm more concerned about how to get my syslog rules from the old syslog viewer. I don't understand why a feature like this would be implemented with no way to migrate rules or even a warning indicating syslog rules are no longer going to work unless you set them up.

dgsmith80

To be fair this is documented in the release notes.

https://documentation.solarwinds.com/en/Success_Center/orionplatform/Content/LM/LA-Orion-Log-Viewer.htm

Upon installation, the Orion Log Viewer replaces the legacy Syslog and Trap Viewers, existing Syslog and traps messages are only available in read-only format, and existing rules are not migrated.

Don't get me wrong I would have liked to have them migrated, but they did give warning.

bleearg13

I'm going to have to disagree with you there. This info is linked off the release notes and is shown under 'Other improvements', giving one the impression that it's a minor improvement. If a core function was going to change and stop working completely, I'd expect there to be a warning box or something, not a blurb about it between "Scalability Engines Installer download improvements" and "Updated and improved localization of Orion Platform product UI for German and Japanese."

Edit: And not only that, there is no mention that the rules are not available to be seen anywhere from the web console (at least that I can find or anyone has responded here with). There's no information about where I can even find them besides my guess of going directly to the database. So, the release notes are incomplete in my opinion, as are the documentation pages.

Martin_Crothers

I had to do sort of the same thing. I knew ahead of time though, so I wasn't reading directly from the database. I had my DBAs load a backup from before the migration to my Orion lab environment and mounted it as the database. Then you can view your rules in Syslog Viewer and Trap Viewer. But it is still a manual move/translate.