Syslog Monitoring

Warning! The Syslog monitoring is supported in LANState Pro only.

Syslog is a standard for the computer data logging. It is used on computer networks based on the TCP/IP protocol.

The Syslog protocol is simple. A sender sends a short message (not longer than 1024 bytes) to a recipient. The message can be sent via the UDP or TCP protocol. Syslog can be used for the computer system management and security auditing. It is supported by a wide variety of devices (like printers and routers) and receivers across multiple platforms. Because of this, syslog can be used to integrate the data logging from many different types of systems into a central repository.

The program can receive Syslog messages and alert the network administrator about them using various methods. To enable the Syslog receiving function, select the "Monitoring | Syslog monitoring" menu item. On the Syslog Monitoring window, you can configure whether the program should Receive all Syslog records or Receive records satisfying filters (and configure these filters). Here, you can also change the Syslog receiving Port. The default Syslog port is UDP 514.

Fig. 1: The Syslog Monitoring window

If there are many devices sending Syslog messages on your network, you can configure a filter that will allow you to filter our unnecessary and unimportant messages. To configure a filter, select the Receive records satisfying at least one condition option and click Add.

Fig. 2: The Syslog filter parameters window

For example, to receive Syslog records from only one host you can enable the Sender's IP address option and specify the host's IP address. If you select the Text option, the program will search the entered text in each received message and alert you only when the specified text is found in the message.

To configure notifications for the Syslog records received, click the Configure alerts... button (See Fig. 1).

Fig. 3: The Alert settings window

The notification methods are the same as when you add and configure monitoring checks.

After enabling the Syslog receiving and configuring the settings, you can close these windows. The Syslog receiving function will continue operating in the background mode.