Technical data

Using Syslog Messaging to Monitor Router Events
303561-A Rev 00
C-5
Figure C-2. Router Event Message Filtering for One Host
Polling the Events Log
Syslog polls the events log buffer on the local slot to retrieve any new messages
logged since the previous polling attempt. Syslog polls the local slot at an interval
determined by the set value of the wfSyslogPollTimer (poll timer) attribute. You
can accept the system default value or set a customized value for this attribute.
Identifying Entity Filters
Each protocol and system service in the router software has a unique entity
number. (For a complete list of entity numbers, see Event Messages for Routers.)
The router software uses an entity number plus the IP address of a specific remote
host to identify each entity filter you configure on the router.
For example, if you configure a filter that selects only messages logged by entity
number 2 (IP) on a router, Syslog forwards those messages only to the host IP
address associated with that filter.
You must also assign a filter index number (wfSyslogEntFltrIndex) to each filter
you configure for the same entity and remote host pair. Assign a value of 1 to the
first filter you configure for a specific entity and remote host pair. To each
subsequent filter that you configure for the same entity and remote host pair,
assign the next consecutive number.
Select by
entity
number
Select by event
number range
Select by event
severity levels
Select by slot
number range
New unfiltered
messages from
the events log
Filtered
event
messages
for a
designated
remote
host
(OR)
Entity filter for one host:
TS0002B