CPI Alarms and Syslog

[nwittenberg]

I want to send all alarms in CPI to a Splunk server via syslog.  Is that possible?

[Flavio Miranda]

Hi @nwittenberg

 It is possible. 

In "Administration / Settings / System Settings" you can go to "Notification Policies"

You can define "Conditions", "Devices Group" and "Destination". Destination can be email address or "Northbound  Trap Receiver" and here you can point to a third party device. 

-If I helped you somehow, please, rate it as useful.-

[nwittenberg]

But no syslog?

[Flavio Miranda]

Syslog you can follow this steps:

Step 1 Select Administration > Settings > System Settings, then choose Mail and Notification > Change Audit Notification.
Step 2 Select the Enable Change Audit Notification check box to enable notifications.
Step 3 If you want to send the messages to specific syslog receivers:
Click the Add button (+) to specify a syslog receiver.
In the Syslog Receivers area, enter the IP address, protocol, and port number of the syslog receiver.
You can repeat these steps as needed to specify additional syslog receivers.
Step 4 Click Save.

-If I helped you somehow, please, rate it as useful.-

[nwittenberg]

That’s just for changed configs. I don’t see that capability under Alarms and Events. I am guessing it is not possible.

[Scott Fella]

nwittenberg,
Why not just define the syslog from the controller and only use PI for the traps?

[nwittenberg · Accepted solution]

I probably should have mentioned this is for wIPS alarms which I think all get sent via NMSP to the controller which then does the crunching of the information which is then sent to PI as SNMP traps.

We found a way for Splunk to handle SNMP traps so we are sending the alarms from PI.

Thanks all for chiming in.