by Roberto Alcocer 

For System Center Forum readers that might have missed our first blog posts, this is Jalasoft’s third article about Xian Io’s functionality in a series of eight. In part 1, we discussed monitoring network device interfaces and port status. In part 2, we talked about monitoring a network device and it’s response time.We tried to come up with solutions to problems that most Network Administrators encounter on a daily basis, so on this occasion we’ll elaborate on Asynchronous Monitoring.

When monitoring a network device or server, network admins focus on monitoring some aspects considered critical and mandatory; therefore, the rules that monitor such properties are designed to cover these critical nodes and counters and will periodically verify that they are within certain normal boundaries.  However, other unexpected events and situations that might affect the normal performance and availability of that server or device could occur.  These events are difficult to foresee and therefore explicitly monitor and could even compromise the state of the whole network.  Knowing about these events as soon as they occur is very critical since solving this problem requires a response soon after the events are triggered.

Taking this into consideration, Xian Network Manager Io implemented a mechanism to asynchronously monitor your devices. This mechanism consists of listening for all the Syslog messages generated on your devices and then triggering an alert on Ops Mgr 07 as soon as an error or particular message that you consider critical is received.

Configuring the Xian Syslog Listener

In order to start listening for any Syslog messages generated on your monitored computers, please follow these steps:

1. Configure your devices to send their Syslog messages to the server where the ‘Jalasoft Xian Task Server’ service is running. Please review your device’s guide for specific steps.

2. Enable the Xian Syslog listener.
   1. Open the Xian console.
   2. Click on the ‘Xian Servers’ button located on the lower left hand corner.
   3. Drill down the Task Server tree until you find the Syslog Server icon, then right click on the ‘Properties’ contextual menu option.
   4. On the ‘Syslog Server’ tab, provide the port where Xian will listen to these messages and then click on the ‘Enable’ button; the ‘status’ text box should now display ‘running’.

3. Create the filters on Xian that will accept or reject any received messages:
   1. Open the Xian console and click on the ‘Syslog message filters’ tab.
   2. Right click on the ‘Syslog messages filters’ working area and click on the ‘Add’ contextual menu option; a configuration dialog will be displayed.
   3. Enter a name for the filter.
   4. Select the action that the filter will perform when a Syslog message that matches this filter arrives (accept the message and send an event to Ops Mgr or simply discard it).
   5. Configure the filtering of the severity levels of the messages, and which severity levels will be considered and which ones will be discarded. To configure this feature, select the ‘Severity’ check box and then select the severity levels for the filter. Please notice that if you click the ‘Select All’ button, all the severity options will be selected.
   6. Optionally select the Syslog messages that will be filtered by contents. For this, check the ‘Contents’ check box and enter a valid regular expression that will be applied to the contents of the Syslog message. The filter will process all the messages that match this criterion only.
   7. The last step consists of configuring the devices or device groups that the filter will be applied to. You can select all the devices that belong to certain categories (e.g. Cisco switches) or select a specific discovered device or server only. To configure this setting, click on the ‘Devices’ tab and click on the device category, or expand certain categories for a list of discovered devices from a specific category, and finally select the desired device or server.

Working with the Filter Order

When the Xian Syslog Server receives a new Syslog message, it will try to match it with the first Syslog filter that captures and processes the message. The Syslog server will compare this message with the first filter, and if it does not match the specified criterion, then it will go to the second, and so on until it finds the filter that captures this message or discards it (if no filter for the message was found). It is because of this, that the order of the filters is very important. You need to consider this aspect when adding a new filter, making sure that it is placed in the best position possible. To modify the filter order, just follow these simple steps:

1.  Open the Xian Io console.

2.  Go to the ‘Syslog messages filters’ tab located at the bottom center pane on the console’s main window.

3.  Verify that all the Syslog filters are sorted by the ‘Order’ column.

4.  Right click on the Syslog filter that you want to move.

5.  Click on the move option that you choose for the filter (move to first, move up, move down or move to last).

6.  Repeat this procedure for each of the filters you wish to move until they are placed on the appropriate position.

After performing these configurations, Xian will start receiving and filtering the Syslog messages generated on your devices and will send the proper events to Ops Mgr 2007 automatically, so you will not need to perform any additional steps on the Ops Mgr side.

If you have any questions or comments please reply to this post, and we’ll make sure to send you an answer as soon as possible, alternatively you could send us an e-mail to techsupport[at]jalasoft.com. For further information on Xian Io for Ops Mgr 07 please visit our website http://www.jalasoft.com/.