OUCE 2014 - Practical Syslog Stragegies and Implementation
Channel: OpenNMS
Date: 2015-01-27

by

Ken Eshelby

Logging is the lifeblood of any technical environment. Let's devise an approach to dissecting syslog messages coming from a variety of hosts and put them to work into OpenNMS event flow. Syslog is a pervasive and mostly standardized protocol that can take you to the heart of issues in your infrastructure. Become friends with it and win the hearts and minds of your organization. Implement it seamlessly into OpenNMS and become a rock star.

This presentation will take you through my strategy for using syslog in a medium size data center environment. I will demonstrate tools used to filter, route and integrate syslog messages into alarms that OpenNMS operators will want to see. OpenNMS is not a message repository so it is critical that we minimize noise introduced into the system. Using shell scripts to categorize and hunt down appropriately important syslog messages is the first step to shaping the information stream aimed at OpenNMS. Key messages need to be identified, and more importantly, a strategy needs to be implemented to catch important messages you may not see for many months and years beyond your implementation. As important messages become identified, they are integrated into a notification flow as alarms. This is the easy part, as event workflow is likely to be setup appropriately to your environment. Syslog messages are simply plugged into the infrastructure to be used as any other event or alarm element.

http://ouce.opennms.eu/en/ouce2014/public/events/57