Syslog alert include message

[azuercher]

Hello,
I have working syslog alerts but the message I does not contain the syslog message that triggered it. Is there a way to modify my template to include the syslog message in the email?

Thanks

[Brad_Bendy]

Syslog alerts worked fine for me out of the box I am pretty sure. What does your template look like?

[azuercher]

Hi, you are correct. My first alert i setup a custom template and that didn’t show the message but my next alert was using the default template and i see the message now. Only problem is the message includes SysObjectID as well as the log snippet and it looks really messy. I’m trying to figure out how to remove the SysObjectID. Here is a sample:

Faults:
#1: sysObjectID = .1.3.6.1.4.1.2338.1.0; sysDescr = Hardware: Intel64 Family 6 Model 60 Stepping 3 AT/AT COMPATIBLE - Software: Windows Version
6.3 (Build 14393 Multiprocessor Free); location_id = 57; msg = 142
Emergency: User(x1111) dialed 911 from\015Station 7399.;

I really only want the last line. I tried tweaking the template a bit but haven’t found the right part yet.

Aaron

[Brad_Bendy]

Hi,

Yeah mine includes the entire message. Looking at the output in the teams message I see a msg => that has the message. Should be able to pull that out. I have to do some more testing with the templates to tweek that sort of thing. Should be possible though

[azuercher]

Is there a way to test a template to view how it would look besides waiting on an alert. THis particular alert can sometime only fire once a month or every couple weeks so its hard to make a change and wait and remember what to change next time.

[azuercher]

After trial and error I found what worked for me: in the alert template replace {{ $value[‘string’] }} with {{ $value[‘msg’] }} to see only the syslog message and not the OID and other info.