Dead host notification to syslog

[eekamouse]

Hi,

I've enabled "Syslogging" and "Dead Hosts Notifications" on Thold (0.3.9) . Only Thresholds notifications are sent to my syslog (and mail). Is there any way to notify syslog about dead (up/down) hosts with Thold? It works only with email notification. Monitor plugin does not have this option too.

Thanks

[AliceHarris]

I would also like to do this.

I am using Cacti 0.8.8b with Settings 0.71 and Thold 0.5.

In the "Cacti Settings (Thresholds)" screen, I have ticked "Dead Hosts Notifications" and provided an email address. When a host goes down, I do receive an email, however I would love to have the event sent to syslog as well.

From the reply to this old post: http://cactiusers.org/forums/post5230.html#p5230 it looks like syslogging was implemented ("This was fixed in SVN a while back.") but I can't find any options to enable it. I've done several google and forum searches to try to find more information, but without success.

Could someone please tell me if it is possible to have "Dead Hosts Notifications" sent to syslog, and if so, how can I enable that?

Thanks and regards,
Alice Harris

[cigamit]

That post was from a long time ago. You can still log threshold breaches to syslog, but some how the dead host alerts code isn't there anymore. Not sure how it got removed.

Honestly, Cacti logs dead host notices into its own log. So if you should set Cacti to log everything to syslog also, and you can easily get them that way.

[AliceHarris]

So if you should set Cacti to log everything to syslog also, and you can easily get them that way.

Thanks, that's a good idea; I'll definitely look into whether we can do that. And thanks very much for the fast reply!

[cigamit]

Np, in the meantime I will add the code back in for dead host to syslog. I need to go back and see who cut it (I will blame Larry until then).

[AliceHarris]

Is it possible to set Cacti to log literally everything to syslog? I have it set up now so that "Host is DOWN" messages appear in syslog - i.e., this line from cacti/log/cacti.log:

06/26/2014 10:55:06 AM - SPINE: Poller[0] Host[193] Hostname[131.242.254.261] ERROR: HOST EVENT: Host is DOWN Message: Invalid SNMP Session

is matched by this line in a logfile that syslog wrote to:

Jun 26 10:55:06 demophon Cacti[10099]: 06/26/2014 10:55:06 AM - SPINE: Poller[0] Host[193] Hostname[131.242.254.261] ERROR: HOST EVENT: Host is DOWN Message: Invalid SNMP Session

However I haven't been able to find any combination of settings that causes this line to also be sent to syslog:

06/26/2014 11:30:06 AM - SPINE: Poller[0] Host[193] Hostname[131.242.254.161] NOTICE: HOST EVENT: Host Returned from DOWN State

(BTW, I'm aware that the host IP addresses are different in the up and down messages and that *.261 is an impossible address. Changing it to *.261 is how I'm faking server downtime.)