H3C Technologies H3C Intelligent Management Center User Manual
Page 702
688
{
Click the radio button to the left of Enabled if you want this rule to be in an enabled state
upon completion of the rule.
5.
Enter a description for this Syslog to Alarm rule in the Description field.
Valid length is 0-128 characters.
The following steps outline the configuration parameters for the alarm generation aspects of this
rule.
6.
Select the type of Syslog event to be processed by this rule from the Syslog Type list.
7.
Select the Syslog levels of the events that is processed by this rule by clicking on the checkboxes to
the left of the Syslog Level for each Syslog level you want to include in this rule definition.
The Syslog level defined here refers to the level set within the Syslog event, not the severity or alarm
level used by IMC to escalate alarms. The value you define here must match the Syslog level setting
in the Syslog event for it to be processed by this rule.
IMC lets you summarize duplicate Syslog entries that match the rule's conditions. The method used
for summarizing Syslog entries is set in the Statistic field. The two methods are: Network and
Single Device.
8.
Do one of the following to select the method for summarizing Syslog entries:
{
Click the radio button to the left of Network if you want IMC to summarize matching Syslog
entries for the entire network.
{
Click the radio button to the left of Single Device if you want IMC to summarize matching
Syslog entries by device.
IMC lets you configure how many times similar or duplicate Syslog entries are received before
IMC escalates the entries to an alarm. This is determined by two variables: the Repeat Interval and
the Repeat Times.
Repeat Interval defines the window of time in seconds that IMC considers Syslog entries duplicate.
9.
Enter the window of time in seconds in the Repeat Interval field.
Valid range is 1–3600 seconds.
10.
To select how many duplicate Syslog entries must be received before generating an alarm, enter
the number of duplicate Syslog entries in the Repeat Times field.
Valid range is 1–10,000.
11.
Select the alarm level that IMC applies to all Syslog entries that match this rule from the Alarm Level
list.
12.
In the Alarm Description field, enter the string that matches some or all of the contents in the Syslog
entry that must be matched for this rule to generate an alarm in IMC.
Valid length is 0–128.
The default value in the description field is %Syslog%. This value requires IMC to match the entire
contents of the Syslog event. You can refine your matching and what is escalated to an alarm by
selecting a subset of the entire contents of the Syslog event. To do so, the string you define in the
Alarm Description field must be a subset of what is defined in the Syslog template specified in the
alarm generation rule.
For Syslog events that point to a security issue, you can forward Syslog alarms to IMC Security
Control Center (SCC).
13.
Do one of the following to either forward or not forward Syslog events to SCC:
{
Click the radio button to the left of Yes in the Forward to SCC field.