SysLog Parser not working after update
-
Not sure if this is solely because of an update, but I went from 4.0.x to current latest (4.2.395) and shortly after I noticed I was not getting SysLog messages via SLACK
This was working perfectly before and i've not changed anything in the parser
I can definitely see SysLog messages in NetXMS by right clicking on node and choosing Logs->SysLog so they are still being received just fine, but parser doesn't seem to be doing anythingIn SysLog Parser I have 'Always process all rules' ticked (always have)
As an example, the very first rule is...
system,error,critical login failure for user (.*) from (.*) via (.*)And to generate an event
This matches perfectly with an actual SysLog message - and has been working for years
i.e.system,error,critical login failure for user [email protected] from 1.2.3.4 via winbox
That event does not appear to be created though
If I go to View->Event Log it's not thereHas something changed? bug?
-
It's a bug introduced in 4.2. It affects syslog and windows event log processing in fields "source" and "tag".
Bug is fixed, will be in next patch release.
Meanwhile you can put * character in syslog tag field, it should work that way.
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login