Adding Syslog Rules

Syslog is a client/server protocol that sends event notification messages to the syslog receiver. These event notification messages (usually called syslog messages) help in identifying the authorized and unauthorized activities like installing software, accessing files, illegal logins etc. that take place in the network. In OpManager Syslog rules help notify you if some particular syslog messages such as kernel messages, system daemons, user-level messages, etc. are sent by the devices. Learn More about syslog monitoring in OpManager.

Apart from the predefined syslog rules you can also add any number of syslog rules. Here are the steps to add a syslog rule:

 

To add syslog rule in OpManager: Syslog rule details 1

  1. Go to Settings → Monitoring → Syslog Rules.
  2. Click on Add New. Add Syslog Rules page opens.
  3. Enter a unique Rule Name.
  4. Enter a brief Description about the rule.
  5. Select a Facility. Facility refers to the application or the OS that generates the syslog message. By default "Any" is selected.
  6. Select the required Severity.
  7. Match Text: Enter the text that needs to be verified for matching. Note: Regex is supported for this field.
  8. Select the Alarm Severity.
  9. Enter the Alarm Message.


    To add syslog rule in OpManager: Syslog rule details 2
     
  10. Click the Advanced button to configure advanced (threshold) rules. This is optional.
     
    1. Number of Occurrences: Enter the number of consecutive times OpManager can receive syslog messages from a device before raising an alert.
    2. Time Interval (seconds): Enter the time interval that should be considered for calculating the number of occurrences.
  11. To clear or rearm the event:
     
    1. Select the Facility Name.
    2. Select the Severity.
    3. Enter the Match Text for clear condition.
    4. Click Save.