Syslog configuration
Configure a Syslog server in your environment before setting Syslog as the alert notification method. With this configuration Syslog notification becomes available for default alerts and report-based alerts.
The following Syslog server details are required for the configuration:
Server IP
Name
Port number
Application name and protocol
The rest of the details can be specified during the configuration.
Before you configure the Syslog notification, you must ensure you have Syslog server already configured in your environment and you have its IP, name, port number, application name, and protocol details. See Configure alerting for a domain.
To configure Syslog notification:
- Go to Alerts > Syslog Configuration. If you are adding the first notification, the page appears blank. During subsequent configurations, the page displays a list of previously configured notifications.
- Select a domain from the Domain list. The Domain list is displayed only if you have access permissions to more than one domains.
- Click Add to open the configuration screen.
- Configure Syslog notification based on the descriptions below:
Field Name
Description
Name
Name of your Syslog configuration. This name appears in the list displayed on the Syslog Configuration page and in the Syslog list when you configure an alert notification.
Description
A short description of your Syslog configuration.
Server Name
Enter the IP address of the Syslog server.
Server Port
Port number on which the Syslog server is running.
Application Name
The device or application that generated the message.
Message ID
The identification number of the message.
Protocol
Protocol used to send the message. Choose from TCP or UDP.
Message Format
Choose from RFC_3164, RFC_5424, or RFC_5424.
Facility
Facility represents the machine process that created the Syslog event. For example, is the event created by the kernel, by the mail system, or by security/authorization processes, and so on. In the context of this field, it is a kind of filter, instructing SMS to forward to the remote Syslog Server only those events whose facility matches the one defined in this field.
Severity
Select the level of severity that will trigger the notification.
SSL
SSL works between the portal and the Syslog server. To communicate securely both need each other's certificates.
Hence, Portal certificate must be present in the portal keystore before configuring Syslog with SSL. See Add a Certificate into the portal keystore in the IT Analytics System Administrator guide.
See Add a Certificate into the Portal Keystore.
Click Accept Certificate to fetch the Syslog server's certificate and display it for verification. After accepting the certificate, it is used to validate the identity of Syslog server.
- Click Test to verify the configuration and connectivity on the Syslog server.
- Click Save. Your configuration appears in the Syslog Configuration list. Once saved, the Syslog configuration name also appears in the list against the Syslog checbox of the Add Alert Notification screen.
Prerequisite: Before you enable Syslog notification for report-based alerts, enable Syslog alerting for the domain from Admin > Domains > Domains > Alerting tab. See Configure alerting for a domain.
To enable Syslog notification for report-based alerts:
- Open the report for which you want to enable Syslog alert notification.
- Right-click on the report and select Alert from the menu. The Alerting screen is displayed.
- Define the alert frequency and select Syslog as the alert delivery mode. Also, specify the Syslog configuration from the list.
- Click OK to save the changes. The portal uses the specified Syslog configuration to send notifications of the report-based alerts.
You can delete the configuration for Syslog notification only if it is no longer attached to any report or alert. The portal displays an error message stating the Syslog is configured with a report or alert when you attempt to delete an attached configuration.
To delete a Syslog configuration from the portal:
- Make sure the none of the alerts or reports are attached to the Syslog configuration.
- Go to Alerts > Syslog Configuration. The page displays a list of configured notifications.
- Select the configuration and click Delete.