Try:
/%OSPF-\d-(…CHANGE)/
Also, you’re matching on the program I guess? That doesn’t work, it only matches against the message
Mine is much simpler, and looks like this:
http://www.maartenmoerman.nl/screenshots/339b57594a065588be5970eb.png
Maarten
From: observium <observium-bounces@observium.orgmailto:observium-bounces@observium.org> on behalf of Serghei Golipad <s.golipad@uk.cdw.commailto:s.golipad@uk.cdw.com> Reply-To: Observium Network Observation System <observium@observium.orgmailto:observium@observium.org> Date: Thursday, July 28, 2016 at 3:48 PM To: Observium Network Observation System <observium@observium.orgmailto:observium@observium.org> Subject: Re: [Observium] Syslog Rules
Hi,
Rule Name: OSPF State Change Message: Not sure what that is, presumably email body message? Regex: %OSPF-\d-(...CHANGE)
Cheers
From: observium [mailto:observium-bounces@observium.org] On Behalf Of Moerman, Maarten Sent: 28 July 2016 14:45 To: Observium Network Observation System <observium@observium.orgmailto:observium@observium.org> Subject: Re: [Observium] Syslog Rules
Hi,
I’ve not seen that message yet. What does the rule look like?
Maarten -- Maarten Moerman | Mgr, Network Engineering | eBay Classifieds | +31-655122247 | mmoerman@ebay.commailto:mmoerman@ebay.com
From: observium <observium-bounces@observium.orgmailto:observium-bounces@observium.org> on behalf of Serghei Golipad <s.golipad@uk.cdw.commailto:s.golipad@uk.cdw.com> Reply-To: Observium Network Observation System <observium@observium.orgmailto:observium@observium.org> Date: Thursday, July 28, 2016 at 3:25 PM To: Observium Network Observation System <observium@observium.orgmailto:observium@observium.org> Subject: [Observium] Syslog Rules
Hi Guys,
Having issue with creating a syslog alert rule, getting the following error
Failed to create new rule. Incorrect rule passed.
Anyone else had this before?
Thanks
PLEASE CONSIDER THE ENVIRONMENT BEFORE PRINTING THIS EMAIL.
CDW Limited is a Company registered in England and Wales. This email is sent for and on behalf of CDW Finance Holdings Limited. CDW Finance Holdings Limited is the UK holding company for CDW Limited trading as CDW. The registered office for CDW Finance Holdings Limited (Company Number 05872067) and its UK group undertakings is 10 Fleet Place, London, EC4M 7RB. VAT Registration 902 1949 39. Confidentiality: This e-mail contains proprietary information, some or all of which may be confidential and/or legally privileged. It is for the intended recipient only. If an addressing or transmission error has misdirected this e-mail, please notify the author by replying to this e-mail and then delete the original. If you are not the intended recipient you may not use, disclose, distribute, copy, print or rely on any information contained in this e-mail. You must not inform any other person other than CDW or the sender of its existence.
For more information about CDW please visit www.uk.cdw.comhttp://www.uk.cdw.com