I'm attempting to create a syslog parser without much success. So far I have:

• Verified syslog messages are being correctly received by the server. I can see many events in the syslog monitor from my devices.
• Created an Event Configuration item with ID 100002
• Created a new syslog parser with the following configuration:

<parser name="">
   <rules>
      <rule>
         <match>LOGIN_FAILED.*</match>
         <event params="0">100002</event>
      </rule>
   </rules>
   <macros/>
</parser>

• Created an Event Processing policy with the following information:
   Condition -> Events match 100002
   Condition -> Severity Filter all items checked
   Action -> Alarm create new alarm with an alarm timeout of 600 seconds

This configuration results in nothing occurring. Any insight into this would be appreciated.