This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.
You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

how to modify the syslog.aspx file to fix wildcard requirement?

FormerMember
FormerMember

When using the built in syslog page within NPM there is a bug (or feature if you're solarwinds emoticons_angry.png ) that when using the 'message pattern' field to attempt to filter syslog messages to find a particular string you HAVE to put a wildcard * both IN FRONT OF and AFTER the string or else you will return zero results.

This is just crazy.

We're running NPM 11.5 just FYI but the problem was there with 11.0.1 and apparently previous versions as well.

I have an open case (case number 766990) with solarwinds to try and get this fixed but they claim that because this is how it's supposed to work. Really? What else would I possibly type into the message pattern other than the fact I'm trying to search for a particular string within a syslog message.

Support says that because this is how it worked in previous versions of NPM they don't consider it a bug. I say that just means it's been a bug that they haven't fixed in multiple versions of orion.

Anyway, I've been doing my own digging and I've identified that the message pattern field is contained directly within the Syslog.aspx file. It calls a function that is located within the Syslog.aspx.cs file (lines 143-144) that reads the string.

I'm wondering if anyone knows some method for me to modify the function to just add the wildcard characters in front of and after the string without asking a user to remember to type the wildcards for the search to work properly. Does anyone have any experience with this?

Line 80 of syslog.aspx

<td><asp:TextBox runat="server" ID="messagePattern"></asp:TextBox></td>

Lines 143-144 of syslog.aspx.cs

if (Request["Message"] != null || Request["MessagePattern"] != null)

  messagePattern.Text = Request["Message"] ?? Request["MessagePattern"];

  • I just tested this. Say the syslog I'm looking for is MYCOMPUTERNAME info logger blah blah.

    When I search on MYCOMPUTERNAME I get nothing back

    When I search on MYCOMPUTERNAME* I get back the syslog I'm looking for.

    When I search on info I get nothing back

    When I seach on *info* I get back the syslog I'm looking for.

    To me it seems that the wildcards are working exactly as they should.

    What is your syslog and what are you putting into the search field.

    I'm on NPM 11.0.1

  • FormerMember
    0 FormerMember in reply to superfly

    This is not the behavior I experience. It was the same on 11.0.1 and now we're on 11.5 and still the problem.

    If you search for MYCOMPUTERNAME you get nothing. If you search for MYCOMPUTERNAME* and the string is somewhere in the middle of the message you STILL get nothing.

    You MUST put a wildcard both in front of and behind the string to get ANY result.

    Why? Why is a wildcard required. If I search for XYZ and only XYZ is contained within the syslog message then it should return the correct result. However if I want to search for ABC that is contained WITHIN a message I have to put 2 wildcards in the search field? What kind of logic is that?

  • To me it's exactly the behaviour I'm expecting. Sure some searches don't require wildcards (as they're just assumed) but even the SQL queries require wildcards so I don't see the issue here.

    You could raise a feature request that syslog searches have assumed wildcards at the start and end of your search item. And then hope people will vote it up.

  • FormerMember
    0 FormerMember in reply to superfly

    I'm not looking to argue the expected behavior. I'm looking for someone that has deep knowledge of modifying the solarwinds files to get what they want from the product.

    Has anyone played with the ASPX.CS files to add wildcard statements to the query?