Forwarding Alarms to a Syslog Server

You can forward alarms to a Syslog server.

➢

To forward alarms whose Destination Type is 'Syslog':

In the Alarms Forwarding Rule Details screen (Alarms > Forwarding > Add Alarm Rule), from the 'Destination Type' drop-down, choose SYSLOG .

Configure parameters according to the table below.

Parameter	Description
Rule Name	Define an intuitive name, to be displayed in the alarm summary screen.
Forward matching alarms/events -or- Prevent forwarding matching alarms/events	Allows or prevents forwarding alarms depending on the destination you select. If you select Prevent forwarding matching alarms/events and then select Minor Alarms from the 'Severities' drop-down under the Rule Conditions tab, then minor alarms are not forwarded. See also related parameters 'Internal Mail Server From Address' and 'Internal Mail Server Real Name' in Configuring Alarms Settings
Enable/Disable Rule	Enables or disables the rule if the parameters and conditions configured under this tab as well as under Rule Conditions and Destinations are met. See also related parameters 'Internal Mail Server From Address' and 'Internal Mail Server Real Name' in Configuring Alarms Settings
Syslog Host IP Address	Enter the IP address of the Syslog host.
Syslog Host Port	Enter the port of the Syslog host.

Click OK; alarms are forwarded to Syslog.

Syslog features a well-defined message format structure detailed in RFC 3164. The severity levels are adjusted to the severity levels of the Syslog protocol.

Live Platform	Syslog
Critical	Alert
Major	Critical
Minor	Error
Warning	Warning
Indeterminate	Informational
Clear	Notice

The message part of the Syslog protocol contain this structure:

Title: <Alarm/Event> <Alarm Name>, received from <Node Name, Node IP> with Severity <Severity>. 
Description: <Source>, <Description>

If the alarm is forwarded from the source global IP address in an HA configuration, the device IP is the global IP address.