I'm trying to create a custom syslog policy to get notified when certain interfaces go up/down.
It seems you can only create policies based on facility, severity, and mnemonic fields. So I created a policy that looks like:
Facility contains LINK
Mnemonic contains UPDOWN
This works well. Problem is when it's a trunk port that has a vlan that's only on that port, the svi also flaps. This also triggers a syslog for every vlan. Is there any way to also filter off the "message" field of the syslog?
And in case anyone's curious why I don't use the built in snmp alerting - it seems delayed by a few minutes compared to the syslog way.
