Syslog Destination

Alarms can be forwarded to the Syslog destination type.

➢

To forward alarms whose Destination Type is 'Syslog':

In the Alarms Forwarding Rule Details screen (Alarms > Forwarding > Add), select SYSLOG from the 'Destination Type' drop-down.

Configure the parameters using the following table as reference.

Forwarding Alarms - Destination – Syslog

Parameter	Description
Rule Name	Define an intuitive name, to be displayed in the alarm summary screen.
Forward matching alarms/events -or- Prevent forwarding matching alarms/events	Allows or prevents forwarding alarms depending on the destination you select. If you select Prevent forwarding matching alarms/events and then select Minor Alarms from the 'Severities' drop-down under the Rule Conditions tab, then minor alarms are not forwarded. See also related parameters 'Internal Mail Server From Address' and 'Internal Mail Server Real Name' in Configuring Alarms Settings
Enable/Disable Rule	Enables or disables the rule if the parameters and conditions configured under this tab as well as under Rule Conditions and Destinations are met. See also related parameters 'Internal Mail Server From Address' and 'Internal Mail Server Real Name' in Configuring Alarms Settings
Syslog Host IP Address	Enter the IP address of the Syslog host.
Syslog Host Port	Enter the port of the Syslog host.

Click OK; alarms are forwarded to Syslog.

Syslog features a well-defined message format structure detailed in RFC 3164. The OVOC'S severity levels are adjusted to the severity levels of the Syslog protocol. The following table maps the two:

Critical	Alert
Major	Critical
Minor	Error
Warning	Warning
Indeterminate	Informational
Clear	Notice

The message part of the Syslog protocol contain this structure:

Title: <Alarm/Event> <Alarm Name>, received from <Node Name, Node IP> with Severity <Severity>. 
Description: <Source>, <Description>

If the alarm is forwarded from the source global IP address in an HA configuration, the device IP is the global IP address.