Log Severity/Priority

This section provides information on configuring the level of priority of log messages that are captured, and the corresponding alert messages that are sent through email for notification.

NOTE: Alert emails are sent when the Send Log to E-mail Address option and the Send Alerts to E-mail Address option are configured on the Log > Automation page.

Topics:

Setting the Logging Level

The Logging Level allows you to filter events by priority. Events with equal or greater priority are passed. Events with a lower priority are dropped. This enables you to filter out lower-level priorities to prevent them being logged in the system.

On the Log > Settings page, you can set the baseline logging level to be displayed on the Log Monitor page. The following logging levels are available for selection, from highest to lowest:

To set the logging level:

All events with a priority equal to or higher than the selected entry are also logged. For example, if you select Error as the logging level, all messages tagged as Error, as well as all messages with a higher priority such as Critical, Alert, and Emergency, are also displayed. The default value is Debug.

NOTE: To display all events, select Debug as the logging level.

Setting the Alert Level

The Alert Level allows you to filter email alerts by alert level. Events with an equal or greater alert level are sent to the specified email address. Events with a lower alert level are ignored. This enables you to filter out lower-level email alerts to reduce the actual emails transmitted.

On the Log > Settings page, you can set the baseline alert level to be displayed on the Dashboard > Log Monitor page:

To set the alert level:

All events with a higher alert level than the selected entry are also logged. For example, if you select Error as the logging level, all messages tagged as Error, as well as all messages with a higher alert level, such as Critical, Alert, and Emergency, are also displayed. The default value is Alert.

TIP: To display all alert events, select Warning as the alert level.

Configuring Event Attributes Globally

Clicking the Configure icon next to the Alert Level drop-down menu launches the Edit Attributes of All Categories dialog. This dialog enables you to set the attributes for all events in all categories and groups at once.

The following global attributes can be modified:

To edit the Category Attributes Globally:

The Edit Attributes of All Categories pop-up dialog appears.

NOTE: The Enable buttons are solid green when all categories, groups, and/or events are enabled, white when all are disabled, and semi-solid when they are mixed (some enabled, some disabled). As this configuration is for all categories, you have to explicitly set the option to “all enabled” by clicking the icon until it is solid green, or to set the option to “all disabled” by clicking the icon until it is white. To configure a single event to be different from the rest of its group or category, you must go into the individual event setting configuration. If you do this, the icon is semi-solid. When the fields say Multiple Values, different values have been specified for one or more category, group, or event. To view the individual settings, refer to Configuring Event Attributes Selectively . To change the setting from Multiple Values into one value for all categories, groups, or events while in the Edit Attributes of All Categories dialog, verify that the option was enabled so the field can be accessed for entering the new value. If the option is disabled, the field is dimmed and inaccessible.

CAUTION: Changing the Event Priority may have serious consequences as the Event Priority for all categories will be changed. Modifying the Event Priority will affect the Syslog output for the tag “pri=” as well as how the event will be treated when performing filtering by priority level. Setting the Event Priority to a level that is lower than the Logging Level will cause those events to be filtered out. Also, as GMS ignores received Syslogs that have a level of Debug, heartbeat messages and reporting messages must have a minimum Event Priority of Inform.

NOTE: The following Redundancy Filter Interval fields enable you to enter time intervals (in seconds) to avoid duplication of a log message within an interval. The range for these intervals is 0 to 86400 seconds. For Syslog messages, the default interval is set to 90 seconds. For alert messages, the default interval is set to 900 seconds.

NOTE: The different options are independent of each other, and you can enable any combination of them and set different frequencies of generation for them. For example, you may want an event message emailed to you, but it not shown in the Dashboard > Log Monitor page. When GMS is enabled, however, care must be taken when modifying event attributes so events used to generate reports are not incorrectly filtered out. User-initiated modifications (implicit changes) of category- and group-level events that may affect factory-defined events, such as those required by GMS, are ignored. Modifications to specific events (explicit changes), however, may override this built-in protection of GMS-required events.

For example, if you set this value to 60 seconds, then when the event Connection Closed first happens at 1:15 p.m., the next Connection Closed event is not logged until 60 seconds after the first one. Any Connection Closed event occurring within the 60-second interval is dropped.

For example, if you set this value to 60 seconds, then when an email alert first happens at 1:15 p.m., the next email alert is not sent until 60 seconds after the first one. Any email alert occurring within the 60-second interval is dropped.

For example, if you set this value to 60 seconds, then when a Syslog message first happens at 1:15 p.m., the next Syslog message is not sent until 60 seconds after the first one. Any Syslog message occurring within the 60-second interval is dropped.

NOTE: If this option is enabled, it is important to verify the email address configured in the Send Log Digest to Email Address field is correct.

TIP: An email alert is one email sent for each event occurrence as soon as that event has occurred. A Log Digest, on the other hand, is a chronological collation of events sent as a single email in digest format. Because it is a summation of events, the event information time period is a mix of older and newer events.

Configuring Event Attributes Selectively

On the Log > Settings page, the columns show the main event attributes that can be configured on different levels: category, group, or each event.

NOTE: The following Edit Log pop-up dialogs may look slightly similar, but the effect of each varies in scope. The Edit Log Category dialog modifies settings for all groups that belong to the same category and, consequently, all events in that category. The Edit Log Group dialog modifies setting for all events that belong to that group. The Edit Log Event dialog modifies settings for one specific event.

NOTE: The Enable buttons for the columns are green when all are enabled, white when all are disabled, and semi-solid when they are mixed (some enabled, some disabled). As this configuration is for all categories, you have to explicitly set the option to “all enabled” by clicking the icon until it is solid green, or to set the option to “all disabled” by clicking the icon until it is white. To configure a single category, group, or event to be different, you must go into the individual dialog or event setting. If you do this, the icon is semi-solid. You can enable or disable a column. In the rows for categories and groups, the enable indicators are grey ( enabled, disabled, and mixed) and cannot be changed except through the Edit Log Category or Edit Log Group dialogs. The rows for events contain checkboxes for enabling () or disabling () the event instead of indicators.

Topics:

Edit Log Category

To set the Event Attributes by category level:

Any changes done at the category level apply to all groups and all events within the selected category.

Edit Log Group

Setting the Event Attributes by group level allows the modification of settings on a smaller scale within a selected category.

To set the Event Attributes by group level:

Any changes done to the group apply to all events that belong only to the selected group.

Edit Log Event

The most granular level, the event level, allows the Event Attributes columns to be directly modified by expanding the selected category into groups, then expanding the selected group into individual events within that group.

To set the Event Attributes by event level:

Any changes done to the event apply to just that events that event within the selected group.