DX Unified Infrastructure Management

Dear experts,

I'd like to use sysloggtw and let it to create alarm directly.

But it seems to me that it doesn't create device and configuration item as I don't see alarm in USM and I'm not able to find device in cm_device and metric in cm_configuration_item_metric according to dev_id and ci_metric_id assigned to the alarm in nas_alarms.

Am I right?

And is it possible to change severity and suppkey for alarms generated by sysloggtw?

Otherwise I'll have to save messages to file and parse the file with logmon. But in this case, I will have to manage file rotation ... Moreover, I'll will have to correlate alarms in NAS to assign alarms to original servers sending syslog messages. Change of source in logmon is not enough for UMP and especially for SOI.

Kind regards,

Marek

Hello Marek,

which is the sysloggtw probe version that you have ?

When sysloggtw probe is triggering an alarm, alarm properties are as follows.

NAS_ALARMS.[dev_id] --> Device ID of the robot where sysloggtw is running on.
NAS_ALARMS.[source] --> IP Address of network device (A)
NAS_ALARMS.[hostname] --> IP Address of network device (A)

this is working as designed fo  sysloggtw 1.40

In a future release, it might be enhanced for alarm to be mapped to remote device in [dev_id] level, because Device ID of the network device (A) may be great fit for NAS_ALARMS.[dev_id] so that Nimsoft USM (User Interface) can give you alarm presentation as one of configuration item of network device (A).

Kind regards,

Britta Hoffner

Hello Britta,

I use sysloggtw 1.41.

I can see little bit different alarm properties than you have described above:

NAS_ALARMS.[dev_id] --> new dev_id listed in sysloggtw log see below, but this dev_id doesn't exist in cm_device

Sep 12 09:18:12:775 sysloggtw: ciGetDeviceIdentifiers - host=10.244.208.14, IP=10.244.208.14 [D80F6A8C187B3BB0346D78F7F56D51C93]

NAS_ALARMS.[source] --> IP address of the server that sends the syslog message (not the server where probe is running)

NAS_ALARMS.[hostname] --> hostname of the server that sends the syslog message (not the server where probe is running)

I think that the issue is NAS_ALARMS.[dev_id], that's why I can't see alarm in USM, neither on the source server nor on probing server.

The enhancement you have described is exactly the way I'd like it to work.

Kind regards,

Marek

Hi. Marek.

Please deactivate / activate discovery_server probe.

The behavior Britter described as a future enhancement, actually have been available with the probe v1.41

It is possible that the issue is discovery_server probe which is not scanning the NIS cache which was created by sysloggtw probe.

Regards,

Yu