On Aug 4, 2017, at 14:31, Adam Armstrong adama@memetic.org wrote:
Hmm. It's difficult to debug the syslog alert generation code path, since it all happens in a process executed by the syslog daemon.
If you cause a syslog entry to trigger, you should see an entry being created in the alert queue table.
It's possible these entries aren't being inserted. Do you have any relevant errors in db.log?
db.log is a zero-byte file.
Alert contacts Assoc has the info correct:
| 33 | syslog | 1 | 2 | | 34 | syslog | 3 | 2 | | 35 | syslog | 5 | 2 | | 36 | syslog | 4 | 2 | | 37 | syslog | 2 | 2 | | 38 | syslog | 6 | 2 | | 39 | syslog | 1 | 3 | | 40 | syslog | 3 | 3 | | 41 | syslog | 5 | 3 | | 42 | syslog | 4 | 3 | | 43 | syslog | 2 | 3 | | 44 | syslog | 6 | 3 |
syslog_alerts is also correct
--------------+-----+-----+----------+ | 1 | 2017-08-04 13:18:26 | 118 | 5 | 54545 | login failure for user joey-test25 from 192.168.77.124 via winbox | SYSTEM,ERROR,CRITICAL | 1 | 0 | 0 | | 2 | 2017-08-04 13:37:46 | 118 | 5 | 227167 | login failure for user test:we-now-have-syslog-alerts-on-routers from 192.168.77.124 via winbox | SYSTEM,ERROR,CRITICAL | 1 | 0 | 0 | | 3 | 2017-08-04 13:39:49 | 118 | 5 | 282127 | login failure for user nv0n-testing:we-now-have-syslog-alerts-on-routers from 192.168.77.124 via winbox | SYSTEM,ERROR,CRITICAL | 1 | 0 | 0 |
Syslog_rules is also correct.
Interestingly, syslog_rules_assoc is empty.
I see nothing that I can translate to an alert queue table though.
Joey