Hi Folks,
I know this must have been requested previously as I'm sure I've read a feature request about it but I cannot seem to find it to add my support. As the title suggests I am looking to add more flexability to the syslog alerting actions. Specifically around changing a node's status. I think the advantages of this feature are pretty clear but just in case see below
Example scenario & justification:
I would heavily use syslog alerting actions to notify our NOC of potential device/network issues. The power of syslog is that it's as close to real time monitoring you are going to get. It provides information on a potentially massive range of issues without eating into your polling capacity and is perfect for identifying high frequency state changes(flapping) that are sometimes missed by polling.
The predominant syslog alerting action I would use is the 'email' action. With this action there are 2 major weaknesses;
1. You are adding an additional window away from the NPM website to check for these alerts.
2. Information overload, depending on the number or types of alerts the mail box can become flooded and alerts missed.
To be able to able to change a node's status from up when a power supply message is received is exactly what I would be looking for. The syslog parser tool was a major step in realistically managing large volumes of syslog but it is not enough I feel. A customisable syslog filter action to adjust node status to place a node in the 'Nodes with Problems' resource is what is needed.
Regards
Ciaran