Alert syslog message not human readable

Satrio_Adi · 17 May 2019 04:44

Hi!

Is there any way to edit the alert syslog message to more human readable instead of OID? I’ve tried to edit the alert template and bind to syslog, but it not changed.

this is example alert syslog:

May 17 11:24:05 10.70.100.101 May 17 11:24:05 librebuntu librenms[1513]: xxx.xxx.xxx.xxx: [OK] eventlog - sysObjectID =&gt; .1.3.6.1.4.1.9.1.1639; sysDescr =&gt; Cisco IOS XR Software (Cisco ASR9K Series), Version 6.1.4[Default]

please advice

Satrio_Adi · 22 May 2019 02:10

Found interesting field in syslog transport code:

github.com

librenms/librenms/blob/e1118b628a294be1b61c1c9602c730b274dd3a8f/LibreNMS/Alert/Transport/Syslog.php

<?php
/* LibreNMS
 *
 * Copyright (C) 2017 Paul Blasquez <[email protected]>
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation, either version 3 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program.  If not, see <http://www.gnu.org/licenses/>. */
namespace LibreNMS\Alert\Transport;

use LibreNMS\Alert\Transport;

This file has been truncated. show original

Seems like syslog transport are hardcoded to send ‘string’ that contain OID of the device, so I decided to edit the code to meet my requirement

Here the result in Splunk (sorry I censored some field):

Hope that Syslog message can modified from transport template in the next update.