Skip to main content

Forwarding events to a syslog

You can configure Lenovo XClarity Orchestrator to forward specific events to a syslog.

Before you begin

Attention
A secure connection is not established when forwarding data to this service. Data is sent over a clear text protocol.

About this task

If resource-based access control is enabled, data is forwarded for only those resources that you can access using access-control lists. If you are not a member of a group to which the predefined Supervisor role is assigned, you must assign one or more access-control lists to the forwarders that you create. If you want to send data for all resources that you can access, select all access-control lists that are associated that are available to you. If you are a member of a group to which the predefined Supervisor role is assigned, you can choose to send data for all resources, or you can choose to assign access control lists to limit the resources.

Common data-forwarding filters are used to define the scope of events that you want to forward, based on event codes, event classes, event severities, service types, and resource that generated the event. Ensure that the event and resource filters that you want to use for this forwarder are already created (see Creating data-forwarding filters).

The following example shows the default format for data that is forwarded to a syslog. Words between double square brackets are attributes that are replaced with actual values when data is forwarded.
{
   "appl": "LXCO",
   "groups": [],
   "acls": [],
   "local": null,
   "eventID": "FQXHMEM0216I",
   "severity": "Warning",
   "sourceID": "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF",
   "componentID": "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF",
   "msg": "The event forwarder destination cannot be reached. Therefore new events are not being
           forwarded.",
   "description": "The event forwarder destination cannot be reached. Therefore new events are not
                   being forwarded.",
   "userAction": "Look in the online documentation to determinate more information about this event
                  based on the eventID. At the moment the orchestrator server can not offer more
                  information.",
   "recoveryURL": null,
   "flags": [],
   "userid": null,
   "action": "None",
   "eventClass": "System",
   "args": [],
   "service": "None",
   "lxcaUUID": "23C87F0A2CB6491097489193447A655C",
   "managerID": "23C87F0A2CB6491097489193447A655C",
   "failFRUNumbers": null,
   "failFRUSNs": null,
   "failFRUUUIDs": "[FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF]",
   "msgID": null,
   "timeStamp": "2021-03-12T18:32:14.000Z",
   "eventDate": "2021-03-12T18:32:14Z",
   "commonEventID": "FQXHMEM0216I",
   "sequenceNumber": "17934247",
   "details": null,
   "device": {
      "name": "xhmc194.labs.lenovo.com",
      "mtm": null,
      "serialNumber": null
   },
   "resourceType": "XClarity Administrator",
   "componentType": "XClarity Administrator",
   "sourceType": "Management",
   "resourceName": "xhmc194.labs.lenovo.com",
   "fruType": "other",
   "ipAddress": "10.243.2.107",
   "_id": 252349
}

Procedure

To forward data to syslog, complete the following steps.

  1. From the XClarity Orchestrator menu bar, click Monitoring (Monitoring icon) > Forwarding, and then click Data Forwarders in the left navigation to display the Data Forwarders card.
  2. Click the Create icon (Add icon) to display the Create Data Forwarder dialog.
  3. Specify the forwarder name and optional description.
  4. Choose to enable or disable the forwarder by clicking the State toggle.
  5. Select Syslog as the forwarder type.
  6. Click Configuration, and fill in the protocol-specific information.
    • Enter the hostname or IP address of the syslog.
    • Enter the port to use for forwarding events. The default is 514.
    • Select the protocol to use for forwarding events. This can be one of the following values.
      • UDP
      • TCP
    • Enter the time-out period (in seconds) for the request. Default is 30 seconds.
    • Optional: Select the format for the timestamp in the syslog. This can be one of the following values.
      • Local time. The default format, for example Fri Mar 31 05:57:18 EDT 2017.
      • GMT time. International standard (ISO8601) for dates and times, for example 2017-03-31T05:58:20-04:00.
  7. Click Filters, and optionally select the filters that you want to use for this forwarder.

    You can select at most one event filter and one resource filter.

    If you do not select a filter, data is forwarded for all events that are generated by all resources (devices, resource managers, and XClarity Orchestrator).

    From this tab, you can also choose to forward excluded event by setting the Excluded Events toggle to Yes.

  8. Click Access Control Lists, and select one or more access-control lists that you want to associated with this forwarder.

    If resource-based access is enabled, you must select at least one access-control list.

    Tip
    Users that are members of a group to which the predefined Supervisor role is assigned can optionally select Match Everything instead of selecting an access control lists so that forwarded data is not restricted.
  9. Click Create to create the forwarder.

After you finish

You can perform the following actions from the Data Forwarders card.

  • Enable or disable a selected forwarder by selecting the toggle in the State column
  • Modify a selected forwarder by clicking the Edit icon (Edit icon).
  • Remove a selected forwarder by clicking the Delete icon (Delete icon).