NPM Syslog rules actions

Yes, "Forward the entry" is missing in global rules. It's because this action is supported only for syslogs and traps but is not supported for windows events, vmware events and log messages. Global rules are processing all message types.

Solution for your request is to create syslog specific rule for forwarding.

Hello p.darila 

I just noticed the FORWARD THE ENTRY option is not showing for the Global Processing policies.

Create new rule under PROCESSING POLICIES > Global Processing.  The action options are

• RUN AN EXTERNAL PROGRAM
  Execute a program or script.
• FLAG FOR DISCARD
  Rules will continue processing, but the entry will not be saved to the database.
• STOP PROCESSING RULES
  Halt further rule processing for the active log entry.

Then create a new rule under PROCESSING POLICIES > Syslog. The action options are 

• FORWARD THE ENTRY
  Send the entry to another system for further processing.
• RUN AN EXTERNAL PROGRAM
  Execute a program or script.
• FLAG FOR DISCARD
  Rules will continue processing, but the entry will not be saved to the database.
• STOP PROCESSING RULES
  Halt further rule processing for the active log entry.

Could you please clarify a little bit more what exactly is missing?

Because, when you are in Log viewer and you want to create Log Processing Rule for Syslog messages, there is an "Forward the entry" action on Actions tab. So you can configure processing rule that will forward all syslog messages to another system without triggering orion alert.

Or are you missing some specific action from alerting that is missing in rule creation?