Adding new alarm
To set EventLog alarms, go to 
> Settings > EventLog Settings > Alarms.
There are two types of alarms: Common settings for both types of alarm are name, description and alarm level. For Syslogs, condition is based on source IP, severity, facility and message content. For SNMP traps, condition is based on source IP, SNMP Trap OID and variable bindings. Both types of alarm have additional settings for triggering condition. You can create alarm condition based on number of messages in unit of time - group alarm (alarm will be triggered and displayed only if all conditions are met more than defined number of times in specified time frame). Screenshot above shows an example of an Alarm configuration. This Error level alarm will trigger if SNMP Trap message is sent from 10.10.10.10, with Trap OID 1.3.6.1.4.1.8072. In following example, Critical alarm will trigger if 3 or more Syslog message is sent form exporter 10.10.10.10 in one minute. This messages need to have severity from 0 to 3 and need to have "Authentication failure" in text of message also. You can also define mail notification. Selected users will receive two mails, one when alarm is activated and second one when alarm is deactivated.
To add a new alarm in EventLog:
Alarm Examples
| Type | Alarm name | Description | |
|---|---|---|---|
| Networking | Link is down | Interface changed state to down | See these alarms in action at our Live Demo. |
| Networking | BGP peer drop | BGP peer has reset the connections | |
| System | Failed password | Failed password | |
| System/Security | Auth failure | Unauthorized access attempt on a vital server | |
| Security | Severity = Alert | Received syslog with Severity 1 |
Read more about Event Alarms.
It is possible to combine more condition criteria. If you do not define a value to a certain criterion, that criterion will not be included in the Alarm condition.