2 Replies Latest reply on Aug 9, 2018 3:16 PM by pwz

    NPM syslog viewer sees multi-line syslogs as individual logs

    pwz

      I've enabled some debugging on a voice gateway router and I am forwarding the logs to Solarwinds for visibility.  I would like to alert based on a specific set of characters, something like

       

      SIP/2.0

       

      However it appears that the alert I've set up only sends me a single line rather than the entire debug message.  Example email we receive looks like

       

      8/9/2018 9:39 AM : 1907028973: SIP/2.0 487 Request Cancelled

       

      However I know there is more to these alerts, as a full message may look like

       

      Jun  3 09:36:18.495 PST: //7195130/FA906982A706/SIP/Msg/ccsipDisplayMsg:
      Sent:
      SIP/2.0 487 Request Cancelled
      Via: SIP/2.0/UDP 1.2.3.4:5060;branch=z9hG4bK08Bbc6e867dac28870b
      From: "Soup People" <sip:+15555555555@1.2.3.4:5060>;tag=gK0851a53b
      To: <sip:+15555555555@4.3.2.1:5060>;tag=9D0EAF25-2575
      Date: Sat, 03 Jun 2017 17:36:18 GMT
      Call-ID: 1432889602_134214362@1.2.3.4
      CSeq: 498233649 INVITE
      Allow-Events: telephone-event
      Server: Cisco-SIPGateway/IOS-15.5.3.S2
      Reason: Q.850;cause=16
      Content-Length: 0

       

      Each of the above lines comes in individually, so I can't use regex to match against it.  Is this something that is a limitation of the Cisco IOS-XE software, or is this how Solarwinds handles syslog messages? Any way to fix it so I can send the entire message?