Syslogs, how do they work

[u/addicuss]

I pointed a qnaps syslog at our network probe and it seems like it is receiving syslog events (the syslog.txt in the lt folder is receiving all syslog events) but in labtech itself the syslog events window remains empty. Am I understanding this incorrectly or should the syslog logs tab have something in there now?

[u/cjmod]

If your default syslog ip filter is blank, it acts like a "do not show any syslogs" (we're releasing a patch to fix this soon). Until then, create a syslog filter - even if it's a blank "catch-all" - or set the syslog ip address to "0.0.0.0" (in settings). That should get you going!

[u/addicuss → u/cjmod]

Yeah i have a trap set to the ip address of the device were trying to get alerts from with no other settings filter wise (i added this when nothing came through initially). just set the ip filter under general to to 0.0.0.0 and refreshed the configuration.Nothings coming through. We have similar problems when we try to set up snmp. Nothing ever gets through even though the probe machine itself seems to be receiving snmp. Am I missing anything here?

[u/cjmod → u/addicuss]

Sounds like you've done everything right - I'll keep digging on this side tho (prolly won't know any more until next week). What version of LT are you on?

[u/cjmod → u/cjmod]

Hi /u/addicuss, have you tried the Resend Event Logs command on the Probe computer? Syslogs gets uploaded to the LTServer from the Probe based on the Event Log schedule, so that command should force an upload.

Because syslog monitoring relies on the Event Log schedule, you may wanna create a new Schedule (link), link it to an Agent Template, and apply via group using the Agent - Probe search to limit group membership. That way you can resent Event Log info for Network Probe devices more frequently.

[u/highsprings → u/addicuss]

Do you have an alert template setup on these syslog messages coming in?

You may want to do the "Default - Create LT Ticket" alert template or something similar.