IMC Syslog Template matching

[Johan de Greef]

Hi!

We are currently implemting some rules to upgrade syslog messages to traps. We are looking to have different pools on our loadbalancer mail different application teams in the event when a pool loses all it's members (unfortunately there are no traps that give enough granularity). 

We have configured different syslog templates to be matched, but are running into issues that a particular rule is getting matched everytime. For example let's say we have 3 pools:
APP-POOL1
APP-POOL11
APP-POOL18

The syslogmessage reads "no available members for pool APP-POOLxx". When pool 11 or 18 go down, IMC matches the pool 1 message, because the syslogtemplate is the same for this part "no available members for pool APP-POOL1". When I disable the APP-POOL1 rule, everything works fine, because the only rules to match are 11 and 18.
Is there a way in IMC to work around this? Can I tell IMC to look at the whole syslogmessage instead of only at the first part when it gets matched?

[LindsayHill]

Hmmm. Looks like a regex problem. You might be able to do something with putting in a more complex regex match.