Details
-
Bug
-
Resolution: Fixed
-
Minor
-
None
-
Professional Edition
-
Observium v17.2.8356, example device is a Cisco 9372PX on 7.0(3)I3(1) - but this issue occurs on all syslog rule notifications.
Description
Example syslog messages received by Observium:
2017 Mar 1 08:57:48 MST: %ETHPORT-5-IF_DOWN_ADMIN_DOWN: Interface Ethernet1/20 is down (Administratively down)
2017 Mar 1 08:57:48 MST: %VSHD-5-VSHD_SYSLOG_CONFIG_I: Configured from vty by username_lol on ipaddress_lol@pts/0
I have rules built for /ETHPORT-5-IF/ and /VSHD-5-VSHD/. Upon receipt of the syslog message, Observium immediately generates a syslog alert. Once the alert sends, I've noticed several odd behaviors:
- When the syslog alert process sends a notification e-mail, it also attempts to email several numbered e-mail addresses, such as 285@observium.example.domain.com. The number in question is the device_id. In this case, '285' is the ID of the example device.
- When the syslog alert process sends a notification e-mail, it does not mark the rule as Notified. It's still listed as "NO" on the Syslog Alerts list.
- When a syslog alert is deleted, a blank line with a rule and delete icon is left under a Contact's "Associated Syslog Rules."
Attached:
- syslog_rules.png - Syslog Rules built
- syslog_message.png - Syslog message sent by device
- syslog_alert.png - Syslog alert generated based on rule(s)
- alerter.php-d.txt - alerter.php debug run on device
- mailer_daemon.txt - /var/lib/sendmail/dead.letter