https://community.hpe.com/t5/imc/imc-syslog-template-matching/m-p/6949046#M3653 <P>Hi!<BR /><BR />We are currently implemting some rules to upgrade syslog messages to traps. We are looking to have different pools on our loadbalancer mail different application teams in the event when a pool loses all it's members (unfortunately there are no traps that give enough granularity).&nbsp;<BR /><BR />We have configured different syslog templates to be matched, but are running into issues that a particular rule is getting matched everytime. For example let's say we have 3 pools:<BR />APP-POOL1<BR />APP-POOL11<BR />APP-POOL18<BR /><BR />The syslogmessage reads "no available members for pool APP-POOLxx". When pool 11 or 18 go down, IMC matches the pool 1 message, because the syslogtemplate is the same for this part "<SPAN>no available members for pool APP-POOL1". When I disable the APP-POOL1 rule, everything works fine, because the only rules to match are 11 and 18.<BR />Is there a way in IMC to work around this? Can I tell IMC to look at the whole syslogmessage instead of only at the first part when it gets matched?<BR /><BR /></SPAN></P> Fri, 17 Mar 2017 12:56:03 GMT Johan de Greef 2017-03-17T12:56:03Z https://community.hpe.com/t5/imc/imc-syslog-template-matching/m-p/6949046#M3653 <P>Hi!<BR /><BR />We are currently implemting some rules to upgrade syslog messages to traps. We are looking to have different pools on our loadbalancer mail different application teams in the event when a pool loses all it's members (unfortunately there are no traps that give enough granularity).&nbsp;<BR /><BR />We have configured different syslog templates to be matched, but are running into issues that a particular rule is getting matched everytime. For example let's say we have 3 pools:<BR />APP-POOL1<BR />APP-POOL11<BR />APP-POOL18<BR /><BR />The syslogmessage reads "no available members for pool APP-POOLxx". When pool 11 or 18 go down, IMC matches the pool 1 message, because the syslogtemplate is the same for this part "<SPAN>no available members for pool APP-POOL1". When I disable the APP-POOL1 rule, everything works fine, because the only rules to match are 11 and 18.<BR />Is there a way in IMC to work around this? Can I tell IMC to look at the whole syslogmessage instead of only at the first part when it gets matched?<BR /><BR /></SPAN></P> Fri, 17 Mar 2017 12:56:03 GMT https://community.hpe.com/t5/imc/imc-syslog-template-matching/m-p/6949046#M3653 Johan de Greef 2017-03-17T12:56:03Z https://community.hpe.com/t5/imc/imc-syslog-template-matching/m-p/6949755#M3666 <P>Hmmm. Looks like a regex problem. You might be able to do something with putting in a more complex regex match.</P> Mon, 20 Mar 2017 21:04:45 GMT https://community.hpe.com/t5/imc/imc-syslog-template-matching/m-p/6949755#M3666 LindsayHill 2017-03-20T21:04:45Z