Syslogd

Overview

The Unified Assurance Event Syslog Aggregator is a generic syslog message listener that receives messages from devices, parses the results with customizable rules and creates de-duplicated events within Unified Assurance.

Syslog Aggregator Setup

1. Review the logic in the rules files referenced in the configuration to see the processing that will be done when syslogs are received:

   • LoadRules will be run during application startup to load data that might be needed during processing.

   • IncludeRules will be read during application startup to load additional files that might be called during processing.

   • BaseRules will be run for each syslog that is received.

   Update the logic as needed.

2. Enable the default Service, unless a specific configuration option is needed.

   Configuration -> Broker Control -> Services

Default Service

Default Configuration

Best Practices

The following list shows the best practices for working with this application:

• Depending on the server specifications and loads, the number of the Threads that the aggregator uses may need to be increased, however, too many threads has also been seen to have negative effects.

• By default, devices send Syslog Messages on UDP port 514, but this can be changed for other environments. If messages are not reaching the Unified Assurance system, check firewall settings in the network.

• By default, syslog messages are sent in a carriage return delimited format.

Rules

This aggregator uses the Unified Assurance standard rules architecture in Perl syntax. For information about creating rules, see the following in Unified Assurance Developer's Guide:

• Core for information about core rules functions.

• Events for information about Event rules functions.

• Application Logging

Tokens

The aggregator exposes the following tokens for rules processing.

$CustomHash->{SubObject} = &share({});

Example Integrations

Creating Custom Rules Files

In this rules creation example, an IP Phone is sending syslogs that appear in the event list with summary:

Missing Rules for-<134>[0]SIP:RegFailed;Retry in 30s
Missing Rules for-<134>+++ send scaps discovery query

Steps

1. Go to the Rules UI:

   Configuration -> Rules

2. Expand the folder path: core -> default -> collection -> event -> syslog

3. Select the syslog folder, then click Add -> Add File. Enter the following:

   • File Name => ipphone.rules

   • Logic

     $Log->Message("DEBUG", " -> Starting running IP Phone Rules");
     
     $Event->{'SubMethod'}  = "IPPhone";
     $Event->{'Summary'}    = $line;
     $Event->{'AlarmGroup'} = "IPPhone";
     
     if ($line =~ "RegFailed"){
         # Phone Registration Failed
         $Event->{'Severity'}  = 3;
         $Event->{'SubMethod'} = "Registration Failure";
     }
     elsif ($line eq "<134>+++ send scaps discovery query") {
         #Discard unwanted event
         $discard_flag = 1;
     }
     else {
         # Catch all for all Phone events
         $Event->{'Severity'} = 0;
     }
     
     $Event->{'AlarmKey'} = $Event->{'SubMethod'} . $Event->{'Summary'};
     
     $Log->Message("DEBUG", " -> Finished running IP Phone rules");
     

     In the example:

     • Events containing the text RegFailed are detected using a Regular Expression match. The event Severity is set to 3 (Minor) and the SubMethod is set to Registration Failure.

     • Events containing the text <134>+++ send scaps discovery query are discarded by setting the discard_flag to 1. This is useful if the event should not be kept.

     • Any other events have the Severity set to 0 (Normal).

     Of particular importance in the example is the $Event->{'AlarmKey'} as the AlarmKey is how events are deduplicated.

   • Click Submit, then enter a commit message, then click OK.

4. In the syslog folder, select the base.includes file. Add the following line:

   • Logic

     IPPhoneRules,collection/event/syslog/ipphone.rules
     

   • Click Submit, then enter a commit message, then click OK.

5. Determine how the aggregator should know the correct processing direction of the event using any of the available data. For example, the event can be based on the source of the Syslog Message:

   elsif ($node =~ "ipphone.*\.example\.com") {
       ...
   }
   

   Or the event can be processed based on the message itself:

   elsif ($line =~ /\<134\>/){
       ...
   }
   

   In the syslog folder, select on the base.rules file. Add the following line:

   • Logic

     elsif ($line =~ /\<134\>/ || $node =~ "ipphone.*\.example\.com") {
         $Event->{'SubMethod'} = "IPPhone";
         $Log->Message("DEBUG", "Running IPPhone Syslog Rules");
         IPPhoneRules();
     }
     

   • Click Submit, then enter a commit message, then click OK.

6. Restart the Syslog Aggregator.

7. Verify the Syslog Aggregator is processing the events correctly.

Administration Details

The following list shows the technical details you will need for advanced administration of the application:

• Package - coreCollection-app

• Synopsis - ./Syslogd [OPTIONS]

• Options:

   -c, --AppConfigID N   Application Config ID (Service, Job, or Request ID)
   -?, -h, --Help        Print usage and exit
  

• Threaded - Multithreaded