Hello All,
I had a request that client wanted to be notified when a particular set of phones unregister and want to be notified via email. So I figured I would just setup a custom RTMT alert. However this has proven to be more of a challenge than I thought. I know you can alert on number of registered phones dropped. But of course this is just all phones. So I thought I could use the SylogStringMatchFound. However it is not picking up when the phone unregisters and triggering the alert.
One limitation is that it only accepts search strings of less than 64 characters. So I can use the actual syslog message when it does unregister...i.e.
%UC_CALLMANAGER-6-EndPointUnregistered: %[DeviceName=SEP00187371C6D6]
So I tried just using just the device name but it never triggers when I force the phone to unregister. This is cucm 9.1.2 and they broke up the syslog into 3 seperate files now. And the endpoint unregisered shows up in the 'AlternateSyslog'. My thought is that the RTMT alert is only checking the 'CiscoSyslog'. I also tried looking for a way to build a custom alert via the performance monitor. But only thing for phones is calls active.
So my general question is has anyone setup a similar alert for specific phones unregistering in RTMT? Of any info someone may have using the SyslogStringMatchFound alert in RTMT.
thx
J
