Differences

This shows you the differences between two versions of the page.

--- admin:add_alert_bash [2024/04/29 13:34] – created veera
+++ admin:add_alert_bash [2024/04/29 13:57] (current) – veera
@@ Line 2: / Line 2: @@
-On Ubuntu , the Trisul email dispatcher reads from /var/log/syslog and matches all lines using a Regex.
+On Ubuntu , the Trisul dispatcher reads from /var/log/syslog and matches all lines using a Regex.
+It then formats and pushes to
+  - Email
+  - Microsoft Teams via WebHooks
 If you push a syslog message in the following format into syslog it will make to the automatic email alert delivery system.
+''"Alert:probe0:context0:0,0,0,0,0,0,IPDRDOWN,TEst ipdr stopped flushing"
+''
 <code>
@@ Line 12: / Line 19: @@
 </code>
+The fields are
+  * Alert:probe0:context0:  -- source of the alert
+  * Timestamp tv_sec
+  * Timestamp tv_usec
+  * Source IP
+  * Port
+  * Dest IP
+  * Port
+  * SigID -- short name for alert
+  * Message