Log Severity/Priority

This section provides information on configuring the level of priority of log messages that are captured, and the corresponding alert messages that are sent through email for notification.

NOTE: Alert emails are sent when the Send Log to E-mail Address option and the Send Alerts to E-mail Address option are configured on the Log > Automation page.

Topics:

Setting the Logging Level

The Logging Level allows you to filter events by priority. Events with equal or greater priority are passed. Events with a lower priority are dropped. This enables you to filter out lower level priorities to prevent them being logged in the system.

On the Log > Settings page, you can set the baseline logging level to be displayed on the Log Monitor page. The following logging levels are available for selection:

To set the logging level:

All events with a priority equal to or higher than the selected entry are also logged. For example, if you select Error as the logging level, all messages tagged as Error, as well as all messages with a higher priority such as Critical, Alert, and Emergency, are also displayed. The default value is Debug.

NOTE: To display all events, select Debug as the logging level.

Configuring Event Attributes Globally

Clicking the tool button next to the Logging Level drop-down menu launches the Edit Attributes of All Categories window. This window enables you to set the attributes for all events in all categories and groups at once.

The following global attributes can be modified:

To edit the Category Attributes Globally:

The Edit Attributes of All Categories pop-up window appears.

NOTE: The Enable buttons are green when all are enabled, white when all are disabled, and semi-solid when they are mixed (some enabled, some disabled). As this configuration is for all categories, you have to explicitly set the option to “all enabled” by clicking the icon until it is solid green or to set the option to “all disabled” by clicking the icon until it is white. To configure a single event to be different from the rest of its group or category, you must go into the individual event setting configuration. If you do this, the icon will be semi-solid. When the fields say, Multiple Values, different values have been specified for one or more category, group, or event. To view the individual settings, refer to Configuring Event Attributes Selectively . To change the setting from Multiple Values into one value for all categories, groups, or events while in the Edit Attributes of All Categories window, verify that the option was enabled so the field can be accessed for entering the new value. If the option is disabled, the field is dimmed and inaccessible.

CAUTION: Changing the Event Priority may have serious consequences as the Event Priority for all categories will be changed. Modifying the Event Priority will affect the Syslog output for the tag “pri=” as well as how the event will be treated when performing filtering by priority level. Setting the Event Priority to a level that is lower than the Logging Level will cause those events to be filtered out. Also, as GMS ignores received Syslogs that have a level of Debug, heartbeat messages and reporting messages must have a minimum Event Priority of Inform.

NOTE: The following Redundancy Filter Interval fields enable you to enter time intervals (in seconds) to avoid duplication of a log message within an interval. The range for these intervals is 0 to 86400 seconds. For Syslog messages, the default interval is set to 90 seconds. For alert messages, the default interval is set to 900 seconds.

NOTE: The different options are independent of each other , and you can enable any combination of them and set different frequencies of generation for them. For example, you may want an event message emailed to you but not shown in the Dashboard > Log Monitor page. When GMS is enabled, however, care must be taken when modifying event attributes so events used to generate reports are not incorrectly filtered out. User-initiated modifications (implicit changes) of category- and group-level events that may affect factory-defined events, such as those required by GMS, are ignored. Modifications to specific events (explicit changes), however, may override this built-in protection of GMS-required events.

For example, if you set this value to 60 seconds, then when the event Connection Closed first happens at 1:15 p.m., the next Connection Closed event will not be logged until 60 seconds after the first one. Any Connection Closed event occurring within the 60 second interval will be dropped.

For example, if you set this value to 60 seconds, then when an email alert first happens at 1:15 p.m., the next email alert will not be sent until 60 seconds after the first one. Any email alert occurring within the 60 second interval will be dropped.

For example, if you set this value to 60 seconds, then when a Syslog message first happens at 1:15 p.m., the next Syslog message will not be sent until 60 seconds after the first one. Any Syslog message occurring within the 60 second interval will be dropped.

NOTE: If this option is enabled, it is important to verify the email address configured in the Send Log Digest to Email Address field is correct.

TIP: An email alert is one email sent for each event occurrence, as soon as that event has occurred. A Log Digest, on the other hand, is a chronological collation of events sent as a single email in digest format. Because it is a summation of events, the event information time period will be a mix of older and newer events.

Configuring Event Attributes Selectively

On the Log > Settings page, the columns show the main event attributes that can be configured on different levels: category, group, or each event.

NOTE: The following Edit Log pop-up windows may look slightly similar, but the effect of each varies in scope. The Edit Log Category window modifies settings for all groups that belong to the same category and, consequently, all events in that category. The Edit Log Group window modifies setting for all events that belong to that group. The Edit Log Event window modifies settings for one specific event.

NOTE: The Enable buttons are green when all are enabled, white when all are disabled, and semi-solid when they are mixed (some enabled, some disabled). As this configuration is for all categories, you have to explicitly set the option to “all enabled” by clicking the icon until it is solid green or to set the option to “all disabled” by clicking the icon until it is white. To configure a single event to be different from the rest of its group or category, you must go into the individual event setting configuration. If you do this, the icon will be semi-solid. You can enable or disable a column. In the rows for categories and groups, the enable indicators are grey ( enabled, disabled, and mixed) and cannot be changed except through the Edit Log Group or Edit Log Category windows. The rows for events contain checkboxes for enabling or disabling the event instead of indicators.

Topics:

Edit Log Category

You set the Event Attributes by category level by selecting a specific category and clicking the Configure button to launch the Edit Log Category window. Any changes done here apply to all groups and all events within the selected category.

Edit Log Group

Setting the Event Attributes by group level, allows the modification of settings on a smaller scale within a selected category. This can be accomplished by selecting a specific group within the category and clicking the Configure button to launch the Edit Log Group window. Any changes done here apply to all events that belong to the selected group only.

Edit Log Event

The most granular level, the event level, allows the Event Attributes columns to be directly modified by expanding the selected category into groups, then expanding the selected group into individual events within that group. Detailed settings for an individual event can also be configured by clicking the Configure button to launch the Edit Log Event dialog.