MonitorWare Knowledge Base

Hello all,

can anyone explaine me how to configure multiple alerts under 1 rule, which can send Emerg(0), Alert(1) & Crit(2) alerts to my mail. I use Winsyslog 4.2, writing all logs to database.

Cheers,

Kiran

also apart from the one above, i would also like to know how to filter all INFO(6) not to write to database!!!

thanks in adv.

Kiran

Hi,

to configure WInSyslog in this way, you will need at least WinSyslog 5.0!
I am sorry, but WinSyslog 4.2 is can not be configured that way.

This goes to both questions.

Kiran,

I think there is some confusion. What Andre means is that it can not be done with a single RULE. In fact, 5.0 can not do it with a single rule, too. However, I assume you will actually use a single RULESET with multiple rules (in which case it is doable).

Am I righ with this?

Rainer

Thanks a lot! but im still confused, atleast we can use multiple rules in version4 to send email alerts, but can we set a rule to write all events except info(6) and debug(7)

thanks,

Kiran

Kiran,

as you write, you can use multiple rules to do what you intend to do.

To write all events to the database except those two, you need to create two rules above the write to database rule - and these three should be the last ones in the rule set.

What you do is use the discard action. If you execute the discard action, the message will be - as it says - discarded, that it nothing else will be executed.

So you can create a rule one that says discard if priority is info.
The next one is to discard if pri is debug.
These two rules will discard those message that you do not like to write to the database.
Then, the next rule says "write to database". It will write ALL messges to the database, but ALL means only those that have not previously been discarded.

Please note that ones discard, you can not re-create a message. This is why you should place this logic to the bottom of your rule set.

I know this whole procedure is clumpsy ... this is why we totally replaced it in the 5.x versions. There you have powerful boolean expressions where you can simply say "priority less then 6" - that's it. But not in 4.x...

I hope this helps,
Rainer

Kiran,

let me add some extra information: your whole scenario can be done with 2rules in WinSyslog 5.x - one for the email alerts and one for the database write. Just in case this info is helpful (maybe for someone else).

Rainer