Syslog alert rule

Help
1

Please help me. I am trying to get work alert rule from syslog in new alert rule builder.

In old one, i get working this alert rule for my huawei switch when is power down

%syslog.program ~ "@POWERFAULT@" && %syslog.timestamp >= %macros.past_5m

Now, I am trying to get working something like this for my ubnt unifi gateway in new builder, but it is not working, please help how to set up this to work. I want to monitor when some of APs connected to ubnt poe switch is down.

syslog.msg LIKE '%@Link Down@%' AND syslog.timestamp >= "@macros.past_5m"

I am geting to my syslog this message TRAPMGR: Link Down: 0/3 from program SWITCH

Thank you.

2

You don’t need the @ in the syslog.msg - however you can import from your old query using the drop down on the left in the alert builder.

3

I used this alert rule

syslog.program LIKE '%SWITCH%' AND syslog.msg LIKE '%Link Down%' AND syslog.timestamp >= "%macros.past_5m"

when I run /opt/librenms# ./poller.php -h oczemplin

i got this message about alert rule

Rule #29 (OC Zemplin UNIFI): Status: NOCHG

what i wanted,because there is not for last 5 minute message from alert rule in syslog

unifi_log
unifi_log1827×413 12.5 KB

My question is why i have this in my alerts ?

alerts_syslog
alerts_syslog1784×399 24.3 KB

What I am doing wrong ?