Search 85,957 posts and 653 resources contributed by 43,597 members or post a topic.

Already Joined? Sign in
New resources. Advanced syslog parser.

Page 1 of 8 (119 items) 1 2 3 4 5 Next > ... Last » | RSS

rated by 0 users
Answered (Not Verified) This post has 0 verified answers | 118 Replies | 29 Followers | 383,552 Views


120 Posts
Points 9,114
Gob posted on Tue, Nov 27 2007 3:45 AM
rated by 0 users

 

New! v.1.01
Advansed Syslog search, Syslog Parser like Cisco Works, Advanced Syslog Summary and Syslog Counts

http://thwack.com/files/folders/orion_custom_views__orion_nodeinterface_views/entry30734.aspx

Comments?

All Replies


758 Posts
Points 7,180
SolarWinds Certified Professional
Thwack MVP
jonchill replied on Tue, Nov 27 2007 9:20 AM
rated by 0 users

Gob

Looks good from the screen shot but I'm not sure where to place the files or where to put the block of code that you mention in the TXT I don't have an Orion foler off the Solarwinds Inetpub folder, do I have to creat the folder and legacy file?

Thanks

Jon

  • | Post Points: 3

295 Posts
Points 878
SamuelB replied on Tue, Nov 27 2007 10:15 AM
rated by 0 users

Gob:

Comments?

 

 

This is great work Gob! I really like it. It is a bit rough around the edges, but it is something that I am able to take and get working easily.

  • | Post Points: 1

120 Posts
Points 9,114
Gob replied on Tue, Nov 27 2007 11:47 AM
rated by 0 users
jonchill:
Looks good from the screen shot but I'm not sure where to place the files or where to put the block of code that you mention in the TXT I don't have an Orion foler off the Solarwinds Inetpub folder, do I have to creat the folder and legacy file?
NO! You must find Your Oion website folder! By default c:\inetpub\solarwinds. Then copy all files from "c--Inetpub--SolarWinds--netperfmon" folder into c:\inetpub\solarwinds\netperfmon\ Also copy all files "c--Inetpub--SolarWinds--NetPerfMon--Resources--1-1-SummaryReports" into c\Inetpub\SolarWinds\NetPerfMon\Resources\1-1-SummaryReports\ And from c--Inetpub--SolarWinds--Orion--NetPerfMon--Resources--Summary :) Also You can edit "legacyProxy.config", by default it plased in c:\Inetpub\SolarWinds\Orion\ You must find Your Oion website folder!
  • | Post Points: 5

295 Posts
Points 878
SamuelB replied on Tue, Nov 27 2007 12:08 PM
rated by 0 users

Gob:

NO! You must find Your Oion website folder!

 

I think it might help if you specify which version(s) this works with. I don't think the Orion folder appeared until lately (8.5 I think?). These resources work for me running Orion 8.5.1.



 

  • | Post Points: 3

120 Posts
Points 9,114
Gob replied on Tue, Nov 27 2007 12:50 PM
rated by 0 users
SamuelB:
I think it might help if you specify which version(s) this works with. I don't think the Orion folder appeared until lately (8.5 I think?). These resources work for me running Orion 8.5.1.
Yes, of course. If SolarwindsNPM version 7.x please ignore readme.txt P.S. I wrote search_syslog resource for version 7.x. It will be share later.
  • | Post Points: 3

758 Posts
Points 7,180
SolarWinds Certified Professional
Thwack MVP
jonchill replied on Wed, Nov 28 2007 2:37 AM
rated by 0 users

I'm currently running 8.1 will it work with my version and if so how can I get it to work?

Thanks

  • | Post Points: 1

110 Posts
Points 603
Mars replied on Wed, Nov 28 2007 8:33 AM
rated by 0 users

I have installed it and got great feedback from my (webconsole) users.
Thanks for the effort!!

Greetings,

Gerjan Peeters Project Specialist MARS INFORMATION SERVICES Business Infrastructure Support Team Mars Netherlands B.V.
  • | Post Points: 3

120 Posts
Points 9,114
Gob replied on Wed, Nov 28 2007 10:43 AM
rated by 0 users
Search Syslog Resource for OrionNPM v7.x http://thwack.com/files/folders/orion_custom_views__orion_nodeinterface_views/entry26325.aspx
  • | Post Points: 5

85 Posts
Points 264
Malvado replied on Wed, Nov 28 2007 12:35 PM
rated by 0 users

This looks great, but I do get an error

 

SQL Open Error: Invalid column name 'access'.

I get this when I click on the 'who' link  

  • | Post Points: 3

120 Posts
Points 9,114
Gob replied on Wed, Nov 28 2007 1:43 PM
rated by 0 users

Malvado:
SQL Open Error: Invalid column name 'access'.

How to fix it.
1. Open syslog_who.asp in any text editor.
2. Find and delete ",nodes.access" in two places.


Before
SysLog.IP, Nodes.Caption, Nodes.NodeID,nodes.access, SysLog.MessageType,

After
SysLog.IP, Nodes.Caption, Nodes.NodeID, SysLog.MessageType,

 

 

  • | Post Points: 5

85 Posts
Points 264
Malvado replied on Wed, Nov 28 2007 1:58 PM
rated by 0 users

 That worked... :)

 

  • | Post Points: 1

758 Posts
Points 7,180
SolarWinds Certified Professional
Thwack MVP
jonchill replied on Thu, Nov 29 2007 2:20 AM
rated by 0 users

Gob

That works a treat in v8.1.

Thanks

Jon

  • | Post Points: 1

83 Posts
Points 201
smcdonald replied on Thu, Nov 29 2007 10:30 PM
rated by 0 users

Nice!
I like it - a few minor issues I seem to be having -
The syslog search resource doesnt seem to work - I just get a blank IE page appear with no content at all - not even an error msg.  I get the same when I try to use either the "msg" or "summ" links in Advanced Syslog Parser and also if I try to change the Time Period to minute/hour/day etc.

But the links to the servernames and the syslog message (where it displays as a number) works, as does the Advanced Syslog summary.

Any ideas?

Thanks for creating a great resource btw - very useful already!

BTW I'm running this on v8.5.1 SP2

  • | Post Points: 3

120 Posts
Points 9,114
Gob replied on Fri, Nov 30 2007 4:47 AM
rated by 0 users

Hi.
Have You Header in syslog_search_action.asp (Syslog search results for "traceback" pattern.)

Try to run it directly with your message pattern. Have You syslog messages with this pattern in selected period?
http://my_solarwinds_server/NetPerfMon/syslog_search_action.asp?Time=day&message=*snmp*traceback*


Have You error 404 (The page cannot be found)?


>Try to view C:\Inetpub\SolarWinds\OrionWeb.log
Have You any error with my files? Access error? Not found error?

!!!! Have You table ACCESS in your NODES tables?


If You do not have ACCESS table You must remove "nodes.access" from any of my files!
Nodes.acces is an undocument feature :)

Try run sql query directly in ReportWriter or MS SQL Management Studio.

This source sql query from syslog_search_action.asp

SELECT SysLog.IP, Nodes.Caption, Nodes.NodeID,nodes.access, SysLog.MessageType,syslogseverity, COUNT(*) AS total
FROM SysLog inner JOIN Nodes on SysLog.IP=nodes.ip_address
--Add here your message pattern---------------
WHERE syslog.message like '%protocol%'
--Add here your period (minute,hour,day,week,month)---------------
and (SysLog.DateTime >dateadd(hour,-1,getdate()))

GROUP BY SysLog.IP, Nodes.Caption, Nodes.NodeID,nodes.access, SysLog.MessageType,SysLog.syslogseverity
order by total desc

This source from syslog_by_msg.asp

SELECT MessageType,syslogseverity, Count(*) As Total
,caption
, (select nodes.nodeID from nodes where nodes.ip_address='10.10.10.10') as NodeID
FROM SysLog left join nodes on (syslog.ip=nodes.ip_address)

Where (SysLog.DateTime >dateadd(day,-1,getdate()))
And (SysLog.IP='10.10.10.10')
AND(SysLog.Acknowledged=0)
GROUP BY MessageType,syslogseverity,caption Order By syslogseverity

This source sql query from syslog_parser_simple.asp

select caption,NodeID,IP, syslogseverity, cnt = count(*)
from syslog left join nodes on (nodes.ip_address=syslog.ip)
where ip='10.10.10.10' and
(SysLog.DateTime >(DateAdd(>hour,-1, GetDate())) )
group by caption,NodeID,IP, syslogseverity order by syslogseverity desc

Any results?

  • | Post Points: 3
Page 1 of 8 (119 items) 1 2 3 4 5 Next > ... Last » | RSS

© 2003 - 2010 SolarWinds, Inc. All Rights Reserved.

Who is SolarWinds?

SolarWinds is rewriting the rules for how companies manage their networks. Guided by a global community of network engineers, SolarWinds develops simple and powerful network management software and network monitoring software for networks of all sizes. SolarWinds also offers a network certification program to become a SolarWinds Certified Professional (SCP).

What is thwack?

thwack, SolarWinds online community site, was designed by network engineers, for network engineers. thwack is a vibrant, growing community of more than 30,000 IT pros who share a passion for technology.

Explore Resources, Answers, Templates, and Advice

Download Free Networking Tools

Learn More About SolarWinds Products