i am trying to search through the syslog web app that is part of Orion. I have a server generating a syslog msg when a perticular process stops. it generates a syslog msg of "the process CMS.exe has exited", right now i have it searching for *CMS* and generating a an email alert. I want to...

OK craig999 is right. This doesn't work. Why I'm not sure. It SHOULD work exactly the way I described but in testing it clearly doesn't work. What DOES work is if you set the Syslog Message Pattern as *ermServDevice*. Why no capital "T"? I have no idea but I have a case open with...

Absolutely. The process is the same as creating an alert for any Syslog message. Go into the Syslog Viewer, click on "Alerts / Filter Rules" and create the criteria for the messages you wish to disregard. On the "Alert Actions" tab click "Add New Action" and select "Discard...

I have not been able to get any of my 2811 routers to send logging messages (vers 12.4 ios) to a syslog server. Routers other than the 2811s do send messages (vers 12.2 ios and earlier). I have included a listing of the ios configuration - I have spent hours on this and maybe it is simple - it thinks...

I'm monitoring a lot of Cisco switches & routers use orion, and receiving the alarms or events from email & sms. I received the overmany short messages (more than 10000) when Cisco switches stack ports flapping, it's expensive! Problem: How do I filter these syslog messages? Could I classify...

All I'm trying to do here is get the "syslog" table to size based on "Retain Syslog messages in the database" slider setting in the syslog console settings. I have the slider now set to one day which is as low as it will go. The DBA's have confirmed that none of the syslog...

oops.. I should have read closer. You want use the "Syslog Message Pattern" not the "Message Type Pattern". It should look like the following screenshot.

This looks right, but without the original syslog message to look at I can't definitely confirm it's correct. Give it a shot though, it should work.

Can you copy/paste the message you are seeing in the syslog viewer that you'd like filtered? Sanitize any sensitive information before posting,