How to alert the administrator of a telnet to router or a switch?

Alerting the administrator of a telnet to router or a switch is possible with Syslog monitoring

Syslog Monitoring in OpManager

Syslog monitoring in OpManager provides a rule-based method of reading syslogs and associating alerts to these syslogs to notify admins or perform other network management tasks. OpManager’s Syslog daemon supports a wide number of devices across multiple platforms. It supports any syslog-exporting device or applications such as Servers (Linux, UNIX, AIX and Solaris), routers, switches, etc.

Follow the steps given below to add Syslog Rules:

Adding Syslog Rules

Syslog is a client/server protocol that sends event notification messages to the syslog receiver. These event notification messages (usually called syslog messages) help in identifying the authorized and unauthorized activities such as installing software, accessing files, illegal logins etc. that take place in the network. In OpManager, Syslog rules help notify you when particular syslog messages such as kernel messages, system daemons, user level messages, etc. are sent by the devices.

Apart from the pre-defined syslog rules you can also add any number of syslog rules. Here are the steps to add a syslog rule:

1. Go to Admin-> Syslog Rules.
2. Click on the Actions drop down menu and select Add New Rule. The Add Syslog Rules window opens.
3. Enter a unique Rule Name.
4. Enter a brief Description about the rule.
5. Select a Facility. Facility refers to the application or the OS that generates the syslog message. By default "Any" is selected.
6. Select the required Severity.
7. Enter the text that needs to be verified for matching. Note: Regex is supported for this field.
8. Select the Alarm Severity.

9. Enter the Alarm Message.

   Note:

   In addition to plain text matching, the Match Text field supports regular expressions (Regex). You can use Regex patterns to match syslog messages based on multiple conditions, alternatives, or exclusions.

   For example, consider the sentence "session closed for user root".

   Condition	Regex Pattern	Example Usage
   AND	(?=.*XXX)(?=.*YYY)	(?=.*session)(?=.*root)
   OR	(XXX)|(YYY)	(closed)|(opened)
   NOT	^(?!.*XXX).*$	^(?!.*user).*$

   • (?=.*session)(?=.*root) matches because both session and root are present.
   • (closed)|(opened) matches because closed is present.
   • ^(?!.*user).*$ does not match because the message contains user.

10. Click the Advanced button to configure advanced (threshold) rules. This is optional. 

    • Number of Occurrences: Enter the number of consecutive times OpManager can receive syslog message from a device before raising an alert.
    • Time Interval (seconds): Enter the time interval that should be considered for calculating the number of occurrences.

    To clear or rearm the event:

    • Select the Facility Name.
    • Select the Severity.
    • Enter the Matching Text.
    • Click Save.
11. Click Save.