Article
05/19/2016

Syslog Events

Updated: May 13, 2016

Applies To: System Center 2012 R2 Operations Manager, System Center 2012 - Operations Manager, System Center 2012 SP1 - Operations Manager

Syslog events can be used to collect messages from Unix systems and other devices in Operations Manager. Syslog rules can be run on an agent that is the receiver of messages from one or more devices. When the rule is run, the agent will listen for messages on UDP port 514. This is the only port that can be used.

Target

Rules and monitors run on the agent computer of each instance of the target class, and they usually access data on the local computer. SNMP rules and monitors typically work with information from a computer or device different from the one running the monitors or rules. For SNMP traps, the monitor or rule needs to be running on the agent that receives the trap. The device needs to be configured to deliver traps to this agent. For SNMP probes, the monitor or rule needs to be running on any agent that is authorized to access the device with SNMP. The device may need to be configured to allow communication from this agent.

Network devices that are discovered with the Discovery Wizard are managed by a resource pool that you specify during the discovery process. A resource pool contains one or more management servers. You can use the classes for these devices as targets, and the rule or monitor will run on each computer in the resource pool. In this case, the device will need to send SNMP traps to each of the computers in the pool and allow access to each computer in the pool for SNMP probes.

Syslog Event Wizards

The table below lists the wizards that are available for both simple and delimited text files.

Management Pack Object	Wizards Available
Monitors	None
Rules	Alert Generating rule
Rules	Event collection rule

Syslog Event Wizard Options

When you run a Syslog event rule wizard, you will need to provide values for options in the following tables. Each table represents a single page in the wizard.

General

The General page includes general settings for the rule including its name, category, target, and the management pack file to store it in.

Option	Description
Name	The name used for the rule. The name appears in the Rules view in the Authoring pane. When you create a view or report, you can select this name to use the data collected by it.
Description	Optional description of the rule.
Management Pack	Management pack file to store the rule or monitor. For more information on management packs, see Selecting a Management Pack File.
Rule Category (Rules only)	The category for the rule. For an event collection rule, this should be Event Collection. For an alerting rule, this should be Alert.
Parent Monitor (Monitors only)	The aggregate monitor that the monitor will be positioned under in the Health Explorer. For more information, see Aggregate Monitors.
Target	The class to use for the target of the rule. The rule will be run on any agent that has at least one instance of this class. For more information on targets, see Understanding Classes and Objects.
Rule is enabled	Specifies whether the rule is enabled.

Build Event Expression

The Build Event Expression page allows you to filter for specific events to be collected or to generate an alert. The Syslog data properties are shown in the following table:

Property Name	Description
Facility	The facility of the event that uses one of the values from the table that follows.
Severity	Numeric value that indicates the severity of the event using one of the following values: 0 - Emergency 1 - Alert 2 - Critical 3 - Error 4 - Warning 5 - Notice 6 - Info 7 - Debug
Priority	Numeric priority of the message.
PriorityName	Text description of the priority level.
TimeStamp	Time that the message was sent.
HostName	Name of the device sending the message.
Message	Text of the message

Important

The event expression will almost always contain the Host Name in addition to one or more properties depending on the criteria that you require. Since a single management server may receive messages from multiple network devices, it must be able to determine which device sent a particular event. If the Host Name is not in the criteria, then a single event will most likely create a separate alert for each device.

Facility Values

The value for the facility property defines the part of the system that the message originated from. It will have one of the values from the following table:

Facility	Description	Value
0	Kernel	Kernel messages
1	User	User-level messages
2	Mail	Mail System
3	Daemons	System daemons
4	Auth	Security and authorization
5	Syslog	Syslog internal messages
6	LPR	Line printer subsystem
7	News	Network news
8	UUCP	Unix-to-Unix copy program
9	Cron	Cron daemon
10	Auth2	Security and authorization
11	FTP	FTP daemon
12	NTP	Network time subsystem
13	LogAudit	Audit level
14	LogAlert	Message alert
15	Cron2	Cron daemon
16	Local0	Local use 0
17	Local1	Local use 1
18	Local2	Local use 2
19	Local3	Local use 3
20	Local4	Local use 4
21	Local5	Local use 5
22	Local6	Local use 6
23	Local7	Local use 7

Configure Alerts

The Configure Alerts page is only available for monitors and alerting rules. Its options are explained in Alerts.

Creating Syslog Event Rules

The following procedure shows how to create a Syslog event alerting rule in Operations Manager with the following details:

Runs on all network devices.
Generates an alert for any message with a severity of error or worse.

To create a Syslog event alerting rule

If you don’t have a management pack for the application that you are monitoring, create one using the process in Selecting a Management Pack File.
In the Operations console, select the Authoring workspace, and then select Rules.
Right-click Rules and select Create a new rule.
On the Rule Type page, do the following:
1. Expand Alert Generating Rules, expand Event Based, and then click Syslog (Alert).
2. Select the management pack from step 1.
3. Click Next.
On the General page, do the following:
1. In the Rule Name box, type Alert on syslog message.
2. In the Rule Category box, select Alert.
3. Next to Rule Target click Select.
4. Select View all targets.
5. In the list of targets, select Node and then click OK.
6. Leave Rule is enabled selected.
7. Click Next.
On the Build Event Expression page, do the following:
1. Click Insert.
2. In the Parameter Name box type Severity.
3. In the Operator box select Less than or equal to.
4. In the Value box type 3.
5. Click Insert.
6. In the Parameter Name box type HostName.
7. In the Operator box select Equals.
8. Click the ellipse button next to Value and click SNMP Agent Address.
9. Click Next.
On the Configure Alerts page, do the following:
1. In the Alert name box, type Syslog error message received
2. In the Alert description box, type $Data/EventData/DataItem/Message$.
3. Click Create.