All Apps and Add-ons

Proposal to replace source=jnpr-syslog with eventtype=jnpr-syslog in the dashboards

Path Finder

This is more of a proposal than a question...

I'm onboarding data for a number of Juniper SRX appliances using a syslog server running rsyslog and a UF. While I could override the source to be "jnpr-syslog" rather than the monitored file's path, I would like to propose that a different "fix" would be to:

  1. Create an eventtypes.conf that contained:
    definition = source=jnpr-syslog

  2. Replace all instances of 'source="jnpr-syslog"' in the XML files for the views with 'eventtype=jnpr-syslog'.

In this way, the app would behave exactly as it currently does but, importantly, it would also allow for the definition of the jnpr-syslog eventtype to be easily overridden locally if needed.

I'm not sure if the author is still maintaining the app. If not I'll make the changes locally myself.

0 Karma