Centerity Monitor. Technical Guide: Syslog Configuration VERSION 4

Transcription

1 Centerity Monitor Technical Guide: Syslog Configuration VERSION 4

2 Forwarding Syslog Messages to Centerity Server 2 Forwarding Syslog Messages to Centerity Server Syslog messages can be monitored by Centerity Monitor. Any syslog message (from different sources) can be forwarded to the Centerity syslog server on port 514. Forwarding OS Syslogs: Configuration of forwarding operating system syslog messages using is done in the syslog configuration file. The location of the file depends on the type of operating system. For example, /etc/syslog.conf or /etc/rsyslog.conf. To forward the messages instead of a log file follow the configuration instruction below: hostname or address>:514 Or for more specific messages with the corresponding condition, for example: hostname or address>:514 Configure interception of syslog messages Syslog templates responsible for filtering and handling of syslog messages that have been received on the Centerity management server. Each template specifies which syslog messages will be handled and in which way. To add a new syslog template: 1) Go to Admin Templates Syslog 2) Click on the button. 3) Fill in the relevant parameters as detailed bellow and click Save.

3 3 GENERAL CONFIGURATION The general tab defined the basic configuration of the template and its metadata. 1. Name* and Description* of the syslog template. 2. Service*: decides in which way messages will be caught by this template and the services affect (if applicable) Disable disable the syslog template Create a new service create a separate dedicated Centerity service for this syslog template. If chosen, a service with the name of the template will be created and visible through the services screen in the system. The service will listen to the syslog messages arriving from its members only. Upon receiving a syslog message which matches all conditions from a host with a member of the service the member will be affected. If chosen a members tab becomes available to create members for the service right away. This also can be done later here or through the services screens Category* choose the category of the new service created Assign to an existing passive service on the same host there will be no new service created for this template. Instead an existing passive service will be affected when a relevant arrives. Only messages received from a host which has a member of the passive service will be handled Passive service* choose the passive service to assign to.

4 Assign to an existing passive service on a specific predefined host - there will be no new service created for this template. Instead an existing passive service on a specific host will be affected when a relevant arrives. Messages from all sources and all hosts will be received and if all conditions are met the member on the predefined host will be affected. It means that this template will always affect only one member, regardless of where the message arrived from Host* Select the host containing the member which should be affected when a message arrives Service* choose the passive service on the selected host to be affected. The following table breaks down the functionality of the different service options: Type Service Source Hosts Host to Affect Disable None None None Create a new service Create a separate service Members of the service Host the message arrived from Assign to an existing passive service on the same host Affect another existing service Members of the service Host the message arrived from Assign to an existing passive service on a specific predefined host Affect another existing service All hosts Predefined specific host Note: The Host Pattern option described in expressions configuration will override the Host to Affect. 3. Facility* Select the facilities of the messages to be caught. 4. Priority* - Select the facilities of the messages to be caught. All priorities may be chosen or specific priorities Severity Select the severity of the events generated per priority. For all priorities one severity for all is selected. If specific priorities are specifies a severity will be selected for each.

5 Filter the not filter will catch all messages except the selected priority. EXPRESSIONS CONFIGURATION The expressions tab allows the definition of patterns for the content of syslog message itself. 1. Remove Pattern regular expression to remove a part from the original message before matching other patterns and logging the message. The part matches the regular expression will be removed. 2. Pattern Type the type of the pattern Textual Search Pattern regular pattern to match the text. Messages which match the regular expression here will be handled.

6 Numeric Search Pattern advanced pattern to match a regular expression which catches numbers with (\d+) to evaluate them with given thresholds. Alerts only when a threshold is breached. If selected, a table will be opened to define labels and thresholds for the captured numbers. There may be up to 4 variables (the first (\d+) is the first variable, the second (\d+) is the second and so on). For each variable the following parameters may be defined: Name give a label to the variable for graphing and reporting Upper Thresholds Warning will alert with warning severity (overrides the severity configuration of the priority) when the current value is bigger than the threshold Upper Thresholds Critical will alert with critical severity (overrides the severity configuration of the priority) when the current value is bigger than the threshold Lower Thresholds Warning will alert with warning severity (overrides the severity configuration of the priority) when the current value is smaller than the threshold Lower Thresholds Warning will alert with critical severity (overrides the severity configuration of the priority) when the current value is smaller than the threshold.

7 7 3. Host Pattern regular expression to extract the relevant host from the syslog message itself. Will always force the event to affect the host extracted overriding the configuration of the Service in the general tab. 4. Sample message Allows to copy-paste a sample syslog message and verify upon clicking on the Test Match button whether the regular expressions are correct, and the numbers and host are caught without failure.

8 8 ADVANCED CONFIGURATION The advanced tab contains different advanced configuration for the syslog template: 1. Message text Defined the message text of the event in Centerity event console. 1.1 Keep Original Message Make the event text the same as the text of the syslog message Prepend to Message Add more text to the beginning of the syslog message Append to Message Add more text to the end of the syslog message. 1.2 Replace with New Message Define the complete text of the event here ignoring the original text of the syslog message. 2. Alert on Error Generate alert. May be unchecked for logging only with no monitoring. 3. Write to Database Specifies whether to log the message in the syslog DB. 4. Line Break Break the event message by a delimiter. Can be used for more convenient display of the event or for only keeping certain lines. 4.1 Delimiter the delimiter by which to break the message. 5. Keep Only Line Numbers After breaking the message into lines only certain lines with interest can be kept. Fill line numbers starting from 0 and separate them by a comma. 6. Comments for user convenience.

9 Viewing and Editing Syslog Interception 9 Viewing and Editing Syslog Interception VIEW SYSLOG CONFIGURATION To view all syslog templates defined go to Admin Templates Syslog. Here are all the templates currently working in Centerity. Available filters: 1. Name. 2. Host - only in case Assign to an existing passive service on a specific predefined host was selected in general configuration. 3. Expressions - the textual/numeric pattern of the template. 4. Category - only in case Create a new service was selected in general configuration. 5. Facility. EDITING, DELETING AND DUPLICATING SYSLOG CONFIGURATION To edit a syslog configuration click on its name and then save. In addition, multiple templates may be selected and then an action chosen for all checked.

10 View logging of syslog messages 10 View logging of syslog messages All messages which were captured by a template with Write to Database checked will be written to the Syslog DB. To view and query the messages go to Monitor Reports Syslog. *There are different filters and queries available.