IMC
cancel
Showing results for 
Search instead for 
Did you mean: 

Trying syslog to alarm in HP iMC, problem with Template Content

 
ryccsalud
Occasional Visitor

Trying syslog to alarm in HP iMC, problem with Template Content

Hello,

I have a syslog template created from this syslog trap:

<15> Dec 4 11:10:40 192.168.194.82 1X : 1X m8021xCtrl:Port 3: Received Auth Failure for client 5cff35-00512f, finished authentication session for RyC.

I created the syslog tempate with this Template Content:

<*> *:*:* $(DeviceIP) 1X  : 1X   m8021xCtrl:Port $(DevicePort): Received Auth Failure for client $(UserMAC), finished authentication session for $(UserName).

 

If I create a syslog to alarm, it rules correctly, but, if I show the "DeviceIP" param, I get the Ip address with date's seconds at left:

40 192.168.194.82.

40=seconds from original date  (Dec 4 11:10:40)

192.168.194.82 = Ip address

 

How should I write the "Template Content" creating my syslog template to show only the IP?

I have tried *, %, ??, etc, but I can't show it without date's seconds.

 

Thans.

 

1 REPLY
ibias
Regular Advisor

Re: Trying syslog to alarm in HP iMC, problem with Template Content

I'm not sure but could be that the "SourceIP" is better then "DeviceIP". Check the content of the syslog and try again.