syslog parser
-
Hi,
I'm attempting to create a syslog parser without much success. So far I have:
- Verified syslog messages are being correctly received by the server. I can see many events in the syslog monitor from my devices.
- Created an Event Configuration item with ID 100002
- Created a new syslog parser with the following configuration:
<parser name=""> <rules> <rule> <match>LOGIN_FAILED.*</match> <event params="0">100002</event> </rule> </rules> <macros/> </parser>- Created an Event Processing policy with the following information:
Condition -> Events match 100002
Condition -> Severity Filter all items checked
Action -> Alarm create new alarm with an alarm timeout of 600 seconds
This configuration results in nothing occurring. Any insight into this would be appreciated.
-
I couldn't get this working with the built-in syslog server. So, I disabled that and configured the OS syslog server to accept remote connections. I then configured LogWatch on the agent and created a parser file et al.
That setup works without issue for me. Not the cleanest implementation, but certainly doable.
-
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login