Syslog is a widely used standard for message logging. It is used for computer management and security auditing as well as for general information, analysis and debugging messages. Syslog is supported by a wide variety of devices across multiple platforms and has become the standard logging solution on various systems.
The Prognosis SYSLOG record is used to hold the messages received by the Syslog Collector. The Syslog Collector (irsyslogcol.exe) is located within the Prognosis Monitoring server and is used to collect Syslog messages containing status and diagnostic information from monitored devices. If the environment consists of multiple Prognosis Monitoring servers, then for scalability, the collection of Syslog messages should be spread across all servers. To do this, each Prognosis Monitoring server should be set up to receive Syslog messages only for the systems being directly monitored by that server.
Prognosis uses 'Device Matching' to automatically tag messages with details of the device that they came from; i.e. Device name, Cluster name, Vendor, Type, Customer and Site. This is done automatically for some vendor devices that Prognosis is monitoring, e.g. Cisco Unified Communications Manager (CUCM), Cisco Unity Connection (CUC) and SBC. 'Device Matching' populates the SYSLOG record with this information from the following sources:
PrognosisNode (PNODES) record
CallManagerGateway (CMGATEWY) record
For other devices, the MAP-DEVICE statement in the SYSLOG Configuration can be used to manually specify the information, or overwrite the information from the automatic device matching, for each message based on the originating IP address.
If there are multiple devices associated with the same IP address, the DeviceName field will be populated with the text 'Multiple Devices Matched'. This indicates that the source of the Syslog message cannot be identified due to an IP address conflict. If the conflicting devices are from the same vendor, the Vendor field will be populated. The other fields will be reset to blank.