Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

Add syslog message to alert email notification

Hi all,

I'm not sure if this is the right forum for this but thought I'd ask.

Is it possible to display the syslog message that triggered an alert in the email notification? For example, I have an alert setup to notify me by email if a port security violation occurs, but the email notification just tells me the device that sent the syslog notification, not what MAC address or port that's in the actual syslog message.

I've been looking through the options but cannot seem to locate a setting for this.

Find more posts tagged with

Accepted answers

superfly

Add this

${N=OLM.AlertingMacros;M=OLMAlertMessage.EventMessage}

All comments

bobmarley

You can use variables in your email. Below are some I use. ${MESSAGE} is the one your looking for.

Message : ${MESSAGE}
Time: ${DateTime}
Hostname: ${Hostname}:
IP: ${IP}

anthonygown

Hello

Can you provide step by step instruction for creating this alert ?

we are running NMP 12.1

tony.johnson

These May Help

https://documentation.solarwinds.com/en/Success_Center/orionplatform/Content/Core-Configuring-Syslog-Viewer-Filters-and-Alerts-sw1250.htm

https://documentation.solarwinds.com/en/Success_Center/orionplatform/Content/Core-Syslog-Alert-Variables-sw2132.htm

Note: Should you choose to upgrade your environment this behavior may change.

https://thwack.solarwinds.com/t5/NPM-Documents/Orion-Log-Viewer-the-New-and-Improved-Version-of-the-Syslog-and/ta-p/511350

https://thwack.solarwinds.com/t5/LA-Documents/Creating-an-Orion-Alert-with-Log-Analyzer/ta-p/515534

Out of curiosity, is there any particular reason you have not upgraded from 12.1?

There have been 5 releases since 12.1.

https://documentation.solarwinds.com/en/Success_Center/NPM/Content/Release_Notes/NPM_12-2_Release_Notes.htm

tom.diehm

Unfortunately, the ${MESSAGE} field didn't resolve the issue.

When I added it, the name of the device is just displayed again stating that the entire device is Up. I need either the entire syslog message to be displayed, or the port and MAC address that fired the alert.

I'm new to SolarWinds reporting so I'm not sure as to what variables are available.

superfly

Add this

${N=OLM.AlertingMacros;M=OLMAlertMessage.EventMessage}

tom.diehm

I just tested this statement and it worked great, thank you!