Forum Discussion

miles_cross's avatar
miles_cross
Icon for Contributor rankContributor
2 months ago

Versa Syslog Alerts

Hi - We are trying to create events from Versa syslog alarms.   The format of the syslog message is in the below URL. Syslog Message Format Forwarded by Versa Analytics : Versa Support The issue ...
TonyAndres's avatar
TonyAndres
Icon for Moderator rankModerator
2 months ago

Hello Miles,

SL1 leverages the rsyslog service to receive syslogs before they are processed into events by SL1. Doing some research, it seems the PRI value is required by rsyslog to properly classify the message it is receiving. In effect, this is not a requirement imposed by SL1, but rather a requirement of rsyslog. 

According to the RFC5424, the PRI should be included in the header encased in < and >. It seems like your system is following the older RFC3164, where having PRI in the header was optional. You may need to update your appliance to include the PRI in the header in order for SL1 to properly process them, as SL1 follows the new RFC. Please let me know if you have any further questions.

Antonio Andres

Principal Technical Support Engineer | ScienceLogic