Syslog Server - Flag/Counter Time Interval - Not working as expected.

Question

Hi I have just upgraded to 9.3.4 syslog server and I am having trouble with setting up new actions with timers counters.

I have approx 20 rules defined and approx 5 of them need a Time Interval Filter.

These filter syslogs from various cisco hardware, one being Fan Faults.

The intial Filter is set to Include = "%FAN" "%ENVIRONMENT" - works a treat

the 2nd filter is a Flag/Counter for Time Interval - currently set to 60 mins

Actions are . 1 = display in ErrorFan,

2. Send snmp trap to server 1

3. forward syslog to server 2

When the timer is enabled the syslogs only show 1 every 60 mins for all devices. We currently have 8 bits of kits reporting fan rotation errors etc, and with the timer set I am only seeing the same device or two every hour - not all 8.

When i remove the timer the syslogs come through every 30sec-1min intreval from each device.

In the Syslog Help guide it states:

"When a message arrives from the host "central-router.company.com" that
contains the words "link down" in the text, the first filter (Message text) will
be true. The Time interval filter is then processed. The first time the Time
interval filter is processed, the result will be true, and the actions that
follow will be performed. A countdown timer using the specified value is
started. In the above example it is 15 minutes. If another message arrives from
the same host that contains the words "link down", the first filter (Message
text) will again be true. If the countdown timer has not reached zero, the Time
interval filter will return false and the actions following will not be
performed."

I cannot get this to work 'per host' it just stops all messages coming through from ll devices except 1.

So I dont think it is correctly storing 'counter/flag' for each host and is just setting the filter for the first message received from any host.

I would also like to know if 60 mins is the maximum, as this can still be quite annoying for backend systems, and It would be great to see this increase to maybe 3 or 4 hours - or to be able to put a once a day for each host filter on. Is there a way around this? for instance can i put a 2nd time interval timer on (when it works properly) for a further 60mins etc so i would get 120 mins in total?

Aforsythe · Accepted Answer

mezdem,

Here you go:

keep your message_text filter in place, get rid of your flags/counters interval filter, then make your first action a run_script action and use that script. You may need to do some basic editing, but I did set the default interval to 14400 seconds for you (240 minutes) so that may be all you want/need and in that case you won't have to edit at all.

It's just a text file though, and vbScript isn't so alien compared to T-SQL so you should be able to look at it and follow along. Think of dictionaries as tables that can only have 2 columns, a primary key column and a value column. If you want to store more than one piece of data, you have to delimit the value column.

My favoritest job ever was a database analyst/administrator. Loved it. I spent all day creating and deleting databases, moving stuff from Btreive in DOS and OS/2 or from Universe in Pick/Unix to SQL, Sybase, MySQL or Oracle.

Let me know if you have any questions and oh yeah... 120 minutes worked. Testing 240 right now, but we won't find out till tomorrow.