cancel
Showing results for 
Search instead for 
Did you mean: 

Syslog severity in Netsight

Syslog severity in Netsight

Marius_Matijosi
New Contributor II
My idea was to create severity alarm based on syslog messages i ECM. But I noticed that all syslog messages are logged and displayed with one severity INFO. Severity is coded in first 3 bits of every syslog message. But ECM is ignoring original severity.
Is there any explanation for such behavior?
Can ECM log syslog messages with original severity?

Thanks for your advices.
11 REPLIES 11

Ronald_Dvorak
Honored Contributor
Release Notes 7.0.8.34
All syslog messages were displaying with a severity of Info, regardlessof the severity with which they were configured. > 1144968

Thanks team !

Marius_Matijosi
New Contributor II
I made two modifications and I get syslog severity in EMC syslog events:
1 . Changed symbol of separator from <> to space :
#$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormatand replace it with:

# Use precise instead
$template precise,"%syslogpriority% %timegenerated% %HOSTNAME% %syslogtag% %msg%\n"

$ActionFileDefaultTemplate precise

2. Modified pattern for Log Manager Parameters -SYSLOG (Event View Manager) - added field %sevint% with separators \w to standard Ubuntu pattern :
%sevint%\w%month%\w%day%\w%time%\w%src%\w%info%

It works.

If there would be a possibility to use different patterns for device groups it would be useful. How to manage this issue?

Thanks a lot... works like a charm.

Hello,
This is instruction for step 2:
Netsight Console
Tools tab /Alarm event/Event View Manager
Available log managers/Syslog -Edit
Pattern - Config
create new Custom pattern configuration - enter name and pattern:
%sevint%\w%month%\w%day%\w%time%\w%src%\w%info%
ok/apply.....

GTM-P2G8KFN