Get Started Knowledge Base FAQs Troubleshooting Latest Release
Submit a Ticket

Menu

    Syslog Monitoring

    Avatar
    Tier3
    • Updated

    Configuration

    1. Configure the machine to send Syslog messages to the Goliath Performance Monitor server
    2. Add your the machine to the Goliath Performance Monitor Inventory
      1. Go to the Management>Inventory>Manage Inventory page and click the New button
      2. In the creation pane, enter the hostname, IP Address, etc and click Add Device
    3. Go the Management>Monitors page 
    4. Click the New button at the top of the page.
    5. For the Group dropdown, select a group in which to store the rule. This is for organizational purposes in the Monitors display.
    6. In the Type dropdown, select the option for Syslog watch.
      1. In the Devices tab, select the device(s) to assign to the monitor
      2. The Options tab is where you will define condition(s) to be monitored
        1. All of the fields in the Options tab are optional for filtering the log messages received. If you leave them blank it will collect all messages 
      3. Save the Monitoring Rule
    7. To view your Syslog Message in Goliath Performance Monitor you can go to the Dashboards>Log Analysis>Syslogs page, where options for View Logs and View Archives are available. 
      1. View Logs: you can view the Syslog alerts in real time
      2. View Archives: filter through past events

     

    Monitoring Rule Field Explanation

    • Message Code(s) Field
      • Defines the eligible comma-delimited list of Message codes to watch for in received Syslog messages.  Is optional as long as at least a Severity code or Facility Code is specified, or 'Match All' is checked.
    • Facility Field
      • Defines the eligible Facility codes to watch for in received Syslog messages.  Is optional as long as at least a Severity code or Message code is specified, or 'Match All' is checked.
    • Severity Field
      • Defines the eligible Severity codes to watch for in received Syslog messages.  Is optional as long as at least a Facility code or Message code is specified, or 'Match All' is checked.
    • Tag Field
      • Optional parameter, if specified, the Tag field in the received Syslog message is scanned for this string, and if found, results in a match condition. 
    • Content Field
      • Optional parameter, if specified, the entire content of the received Syslog message is scanned for this string, and if found, results in a match condition. 
      • String is NOT case sensitive
      • Multiple strings can be specified separated by either a comma, an/or plus character. Comma separated strings are treated as a Boolean OR whereas Plus separated strings are treated as a Boolean AND. Mixed separators ARE supported with the comma-delimiter being the higher priority. For example, 'str1+strg2, strg3+strg4' would result in a match if 'strg1 AND strg2' OR 'strg3 AND strg4' are found in the Syslog message.
    • Match All Checkbox
      • Optional parameter to make it easy to specify that the watch should capture all Syslog messages. This parameter when checked supersedes Facility, Severity, and Message Codes.
    • AND Params Checkbox
      • Specifies, when set, that a match must occur on all of the parameter fields above that have been specified (Boolean AND); otherwise, if not set, a match can occur on any of the parameter fields above that have been specified (Boolean OR).
    • Precedence Field
      • Specifies how this Monitoring Rule is handled if the received Syslog message satisfies the criteria of multiple Monitoring Rules.  A higher-precedence (1 is higher than 2, etc.) trumps Monitoring Rules with a lower precedence. 
    • Archive Only Checkbox
      • Use this option for high-volume collection, if there are no alert 'Actions' Specified. By default, any Syslog Message matching the Watch is both written to an Archive file and written to the Database. With this 'Archive Only' option, you increase Performance by writing to the Archive file only, and by-passing the Database. See 'Syslog View/Archive & Report' on the 'Report' Menu
    • Archive Never Checkbox
      • Use this option to skip the write to the Archive file when you do not have high-volume collection requirements and/or if you don't require saving Syslog messages for long term. Messages are only written to the Database. Specify an alternate Archive folder for this Watch versus the default folder '...\\MonitorIT\\SyslogArchive'
    • Archive Path Field
      • Optionally specify the path to an alternate Archive folder for the Syslog messages that match this Watch versus the default folder '...\MonitorIT\SyslogArchive'. Format is Drive:\.... or UNC path, for example, \\MachineName\c$\SyslogAlternate; Drive can be a mapped drive. The GPM Server component needs to have access rights to the specified folder.

    Additional Configuration

    For additional configuration options please see the following articles: