> For the complete documentation index, see [llms.txt](https://docs.itconductor.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.itconductor.com/~/changes/j1RdUn49WBcajmJEmXUf/users-guide/monitoring/syslog-monitoring.md). # Centralized Syslog Monitoring IT-Conductor central Syslog Monitoring architecture leverages IT-Conductor gateways that are already deployed to on-premises/in-cloud environment and enable consolidated collection, monitoring, management, notification, and auditing of Syslog messages In the context of IT-Conductor "Site" construct multiple Syslog servers and the messages they captured can be dedicated to geographically or organizationally separated environments with separate monitoring and notification policies (For example QA/Development vs. Production etc.) Please make sure when you are configuring new Syslog servers - you assign it to a desired Site, correspondingly make sure the Linux hosts and devices that forward Syslog messages belong to the intended grouping. When Syslog servers are configured they will show up in IT-Conductor service tree under the corresponding Site:

Syslog Site Grid

The grid incorporates all related Syslog servers where you can monitor their status and logs as well as provides management interfaces: ### Syslog Search This is interactive search facility for Syslog messages, clicking on it will open the query interface:

Figure 1: Syslog Interactive Search

You can search by multiple columns, all unrestricted values support Regex expressions so relevant messages can be found quickly. While time-search is not supported, sorting by time and filtering by other fields let you quickly and efficiently locate the issues and understand the sequences of events. ### Monitoring IT-Conductor makes it very easy to watch for certain messages and alert on their occurrence. Clicking on **Monitoring** link will open a list of defined monitors:

Figure 2: Syslog Monitors

You can edit and create new monitors either from scratch by clicking :

Figure 3: New Syslog Monitor

... or from pre-configured templates by clicking :

Figure 4: Syslog Monitoring Templates

Click on the template name to create a new Syslog monitor - same as "from-scratch" form but some of the values are pre-set. After the new Monitor is created it will show on the grid in a few minutes when the periodic discovery is complete. Clicking on a monitor in the grid will open an interactive chart:

Figure 5: Syslog Monitor chart

In the chart, the data-points are interactive, clicking on them will popup a list of Syslog messages for the interval:

Figure 6: Syslog Monitor Interval

You can navigate intervals back and forth with **<** and **>** controls. While in the chart if an icon shows at the bottom this indicates that alerts were generated for the interval, clicking on that icon will show the list of alerts The default monitoring "overrides" are preconfigured causing an alert to be generated for each instance of matching Syslog message, however, if required more fine-tuned/complex scenarios can be configured as required. The Override facility is the same as any other IT-Conductor monitor and can trigger customized alerts or recovery actions. Please contact the IT-Conductor Support team for guidance. ### Alerts Click on Alerts will show all recently generated alerts in chronological order:

Figure 7: Syslog Alerts

### Notifications The notification mechanism is the standard IT-Conductor subscription-based approach, you can have individuals or groups of individuals subscribe to specific monitors or sites, etc., and based on the subscription the relevant alert will be sent to the e-mails addresses or SMS numbers as configured. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.itconductor.com/~/changes/j1RdUn49WBcajmJEmXUf/users-guide/monitoring/syslog-monitoring.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.