Syslog Alert Rules

[skywalkerznz]

Hello!

I have configured some simple alert rules and I see most of the times the rule does not get hit, its very simple begins with mgt, I tried changing that to contains mgt, and still i see not all I see, is there anything I am missing. Thank you.

[macan]

Please show screenshot of rule and at least one line which you want alerted

[skywalkerznz]

Please see attached rule and syslog entry.

[skywalkerznz]

If I search from syslog, I can see 17 messages matching the search string, on the Alert I only see 6, duration of search is 1 day.

[TheWitness]

Syslog alerts operate on what is in the pipeline, not what happened in the last day. So, it looks at the table syslog_incoming only as it's currently designed. There is an RFE to look back X-minutes in the past, but to date, no one has provided a pull request to implement such a feature. I would do it, but I have a day job and my priorities are not the same as people from the community when I volunteer my time to work on Cacti. As a ripen (read get old an grey), the boss won't give me the time I need to fix all the needs fixing/enhancing in Cacti and it's various plugins.

[skywalkerznz]

Hi The Witness!

Thank you for clarifying how syslog alerts work, I thought something I was doing was not right, but great work, will wait when you have time to add this, may be someday you might get day off and decide to write little code!

Thank you for the excellent work.