CN-MARS user rule question

[jwalzer]

We have the MARS box on our network and we are pushing both syslog and SNMP from our Cisco routers and switches to it. The other day an incident was triggered on a router and the raw message was that a fan failed on the router. How do I create an email alert based on this incident for any Cisco device whose fan fails?

Thanks,

Jeff

[umedryk]

As far as I know, you cannot configure a router to generate an alert when the Fan fails.

[donlon]

Try creating a User Rule and under the "keyword" field place a snippet of the routers syslog message thats unique to that event. Then the rule should trigger when the MARS sees that string.

In new code the MARS understands Regular Expressions though I'm not sure if this applies only to creating custom devices or if they can be used in the User Rule keyword field too.

One of the fields thats available when constructing User Rules is "Action" (if I recall correctly). This field allows one to specify what type of action that should be taken when a rule triggers. Sending an e-mail is one of the options.