Create OLV Syslog Rule for an RTCD with multiple conditions in NCM

5/12/2020 9:43 PM

5/12/2020 9:43 PM

If you only want to be alerted if specific things change in a configuration and narrow the scope to security related changes, you can do that by creating an OLV Syslog rule that isolates certain word in from the Syslog. 

Network Configuration Manager

Steps

• From the Orion Web Console (website)
  • Click 'ALERTS & ACTIVITY'
  • Then 'Syslogs'

• Click on 'CONFIGURE RULES'

• Expand 'SYSLOG'
• Click on 'My Custom Rules'
• Then 'CREATE A RULE

• Enter the 'Rule Name'
• Click 'NEXT'

• Click the radio button for 'Fire this rule for specific sources'
  • Choose IF 'Vendor'
  • Then 'Is Equal To'
  • and 'Cisco'
• Under 'LOG ENTRIES' click the radio button for 'Look for specific entries'
  • Choose IF 'Message'
  • Then 'Contains'
  • And type "Configured from console"
  • Then add an 'AND'
  • Choose 'Message'
  • Select 'Contains'
  • Then Type the word you want to search for, example 'Hostname'
  • Add an 'OR' field and repeat 
  • Message 'Contains' the next word to search for, example 'IP Address'
  • Once all the search criteria are entered click on 'NEXT'

• Click 'ADD AN ACTION'  and check the box 'Send a Log Rule Fired event to Orion Alerting' (this way you will be notified when conditions are met. 

 

• Select 'RUN AN EXTERNAL PROGRAM'
• Click on 'CONFIGURE ACTION'

 

• Under 'Add an Action' in the 'Program to run' section type "SolarWinds.NCM.RTNForwarder.exe"
• Enter the following 'Command line arguments' "${IpAddress}, RealtimeNotification, ${DateTime}, ${Message}"
• Click 'DONE'

• Back on the 'Rule Actions' page under the 'ALERT INTEGRATION' section
  • Click the checkbox for 'Send a Log Rule Fired event to Orion Alerting'
  • Check the box 'Create new alert that fires whenever this rule triggers'
  • You can customize this a little more if desired

• The 'Rule Summary' should look something like this

• After saving, you should see the following on the 'Log Processing Configuration' page