-
Re: Possible to send Kiwi alerts based upon CP's from Orion?
mkarak Jun 29, 2010 8:43 AM (in response to sotherls)Hi,
there is a way how to achieve this using Orion but it's quite complicated. Let me try to explain.
First of all, you will need to upgrade to Orion 10.0. This version brought some improvement to syslog processing that is necessary to make this work.
To be more specific (from Release Notes of Orion 10.0):- Orion NPM node variables are now available for use in Syslog and trap alerts.
- Forwarded Syslog messages may now be configured to retain the IP address of the original message source
Currently it is not possible in Orion to filter incoming syslogs directly by custom property but there is a workaround. You can create a rule that will change syslog type to value of requested custom property for given source node and then create one rule for each message type (each possible value of custom property) with email action to responsible people.
For example: I have a City custom property for nodes and I want to forward syslog messages only to person responsible for particular city. This needs to be done:
1. Create new action in Kiwi server to forward all syslog messages to Orion (do not forget to check Retain the original source address of the message checkbox)
2. In Orion Syslog Viewer create a new rule with Modify Syslog Message action called for example Change Syslog Type to City
-- Set New SysLog Message Type field to ${Nodes.City}3. In Orion Syslog Viewer create a new rule for each possible value of City custom property
-- In Message tab change Message Type Patter to city name (e.g *Austin*)
-- Add Send E-Mail action with recipients responsible for given cityHope this helps.
Milan