cancel
Showing results for 
Search instead for 
Did you mean: 
Create Post
Level 14

Syslog rules gone

I upgraded to 12.5 last week and I just discovered that Syslog Viewer is gone. Okay, fine - it wasn't clear or I missed the part during the upgrade that detailed all of this. I then noticed that there are no more syslog rules set up to forward my syslogs to email, which is something we used extensively. I see that this is appears to be possible with the new syslog alert engine, but my question is, do I seriously need to go through, one by one, to reconfigure all my rules by reading them in the database? Also, is alerting based on MessageType *really* not an option anymore?

0 Kudos
6 Replies
Level 10

I had to do sort of the same thing.  I knew ahead of time though, so I wasn't reading directly from the database.  I had my DBAs load a backup from before the migration to my Orion lab environment and mounted it as the database.  Then you can view your rules in Syslog Viewer and Trap Viewer.  But it is still a manual move/translate.

0 Kudos

Unfortunately there’s no migration path much like upgrading to the newer versions of NTA. Worth asking support as this may have changed you never know but here’s the feature comparison of the legacy syslog/trap to the new LA/OLV. It still notes that filtering by message type isn’t supported.

If you go to create a rule does the option message type show up in the conditions at all for you?

https://documentation.solarwinds.com/en/Success_Center/LA/Content/LA/LA-Syslog-Trap-Parity.htm
0 Kudos

No, it does not. I'm more concerned about how to get my syslog rules from the old syslog viewer. I don't understand why a feature like this would be implemented with no way to migrate rules or even a warning indicating syslog rules are no longer going to work unless you set them up.

 

0 Kudos

To be fair this is documented in the release notes.

https://documentation.solarwinds.com/en/Success_Center/orionplatform/Content/LM/LA-Orion-Log-Viewer....

  • Upon installation, the Orion Log Viewer replaces the legacy Syslog and Trap Viewers, existing Syslog and traps messages are only available in read-only format, and existing rules are not migrated.

Don't get me wrong I would have liked to have them migrated, but they did give warning.

- David Smith

I'm going to have to disagree with you there. This info is linked off the release notes and is shown under 'Other improvements', giving one the impression that it's a minor improvement. If a core function was going to change and stop working completely, I'd expect there to be a warning box or something, not a blurb about it between "Scalability Engines Installer download improvements" and "Updated and improved localization of Orion Platform product UI for German and Japanese."

Edit: And not only that, there is no mention that the rules are not available to be seen anywhere from the web console (at least that I can find or anyone has responded here with). There's no information about where I can even find them besides my guess of going directly to the database. So, the release notes are incomplete in my opinion, as are the documentation pages. 

0 Kudos

There's another related feature that is no longer available...

Under the legacy Syslog and Trap Viewer apps, you could export the rules and then import them into another server that's also running legacy Syslog and Trap Viewer.

It would seem reasonable for the developers to at least offer the same feature on the new Log Viewer.  That is, we should be able to export the rules and import them into another server that's also running Log Viewer.  That was no fun for us, since we have over 150 rules on each of our SolarWinds servers.  So, we had to re-create every single rule in each both of our SolarWinds instances. 

By the way, we are getting ready to deploy two more SolarWinds instances.  So, I cringe at the thought of having to re-create all 150 rules on the other two SolarWinds servers. 😫

0 Kudos