Denj dobrij Victor.
Nastroil poluchenie eventov kak raspisano nize. Est' vopros: event poluchjaju na NetXMS server, no v e-mail body hotelosj bi videt' toze chto i v evente. V nastrojkah "event processing policy editor" est tablica "scripts" mozet est' obrazec configa?
Spasibo
@victor said in Configuration for monitor Windows syslog:
Hi!
For example, we want to send email for every critical event in Windows "Application" event log. To achieve that, we should:
- Create new event in NetXMS (via Control Panel -> Events). Remember ID assigned to new event. For example, let's call our new event EVENTLOG_ERROR and assume that ID 100001 was assigned to it. Set message template to
ERROR: %1
- Create parser configuration file. To generate event with code 100001 on each error message it will looks like following:
<parser>
<file>*Application</file>
<rules>
<rule>
<severity>1</severity>
<match>(.*)</match>
<event params="1">100001</event>
</rule>
</rules>
</parser>
- Configure LogWatch subagent:
in main section of nxagentd.conf:
SubAgent = logwatch.nsmin LogWatch section:
*LogWatch
Parser = our_parser_file.xml
Restart agent
Add appropriate rule to event processing policy (send e-mail for each EVENTLOG_ERROR event)
That's all - now server should send e-mails for every error message written to application event log.
Best regards,
Victor