Syslog from client to LibreNMS

Help
1

Hi,

I’m just wondering what the benefit is to input client syslogs into LibreNMS ?

I’ve just done this one a test server, and see the syslogs in the interface now, but what can I do with them now they are in there?

I can see a benefit of this would be to filter for a keyword or critical error, and generate an alert from that. Can this be done?

Michael.

2

Alerting and rules can be setup in librenms, also when you add devices with that are sending syslog entries they will show associated with that device in librenms web ui.

For example:

log in detected on device %syslog.timestamp = %macros.past_5m && %syslog.msg ~ “@logged in@”

WARNING PoE Over Power on Switch %syslog.msg ~ “@PoE usage has exceeded threshold of 80@” && %syslog.timestamp = %macros.past_5m

CAUTION Syslog Received Emergency Priority Msg
%syslog.timestamp = %macros.past_5m && %syslog.priority ~ “emerg” || %syslog.priority ~ “emergency”

3

Hi Kevin. Thanks.

Is there documentation on-line for example alerting and rules?

I’m playing with this now, playing with the interface seeing what I can understand about it.

Michael.

4

I just posted some examples, let me know if need any help or more examples.
All the documentation is here https://docs.librenms.org/Alerting/

5

Hi Kevin,

Thank you, that is a great start.

With web hosting, it’s very common that these errors show up for PHP apps:

Fatal Error: Allowed Memory Size of 134217728 Bytes Exhausted

where 134217728 could really be any number that the PHP config has limited the memory_limit variable to.

How would I generate a rule for that?

Thanks.

Michael.

6

Depends on how the message is shown in syslog.

maybe something like this
%syslog.timestamp = %macros.past_5m && %syslog.msg ~ “@Fatal Error@”

7

Hi Kevin. Thanks that makes sense. I have added that rule under the “Alerts → Alert Rules” section.

image
image1166×68 4.2 KB

I have also ingested the syslogs for 3 hosts into LibreNMS.

2 of the hosts are relevant for that rule, while the third is not.

Does the above rule get applied to all 3 hosts immediately?

Or, do I need to specify something in particular to allow that rule to work with only 2 of the hosts and not the 3rd ? ( maybe that rule mappings option I see there? )

Please advise. Thanks.

Michael.

8

By default, the rule is checked against all devices. But yes you could do “rule mapping”.

1 Like