Log Rules

Log Rules

Settings

Log Rules

Define rules to process incoming Syslog, Windows Event Log, and SNMP Trap entries. Log rules can tag entries, discard irrelevant logs, create events, raise alarms, and control the flow of log processing.

Overview

Log Rules in Cloudmon apply conditional logic to incoming log entries from Syslog, Windows Event Logs, and SNMP Trap. When a log entry matches the conditions defined in a rule, Cloudmon executes the configured actions such as tagging the entry, flagging it for discard, generating an event, or raising an alarm. Rules are processed in sequence and can include flow control to stop further rule processing for a matched entry.

Navigate to Settings → Configurations → Log Rules to view and manage all log rules.

Creating a Log Rule

  1. Navigate to Settings → Configurations → Log Rules.
  2. Click the Add button to add a new log rule.
  3. Fill in the configuration fields and action fields as described in the tables below.
  4. Click Save.

Configuration Fields

FieldDescription
EnabledDetermines whether the rule is active. Set to Off to disable the rule without deleting it.
NameA descriptive name for the rule to identify its purpose.
Probe / ServersThe probe (for Syslog and SNMP Trap rules) or Windows server (for Windows Event Log rules) to which this rule applies.
Log TypeSpecifies whether the rule applies to Syslog, Windows Event Logs, and SNMP Trap.
ConditionsDetermines whether the rule applies to every log entry or only to entries that match specified conditions such as severity level, event ID, or message content.
Active Time WindowDefines the time window during which the rule is active, allowing rules to be scoped to business hours or maintenance windows.
Entry CountSpecifies whether the rule triggers on every matching log entry or only after a defined count is reached.
FloodWhen enabled, there is no cooldown period between rule triggers, allowing the rule to fire continuously on every matching entry.

Action Fields

ActionDescription
Tag the EntryAdds a tag to the matching log entry for easy identification. Tags can be used in later rules, log searches, and visualisations to categorise and filter log data.
Flag for DiscardMarks the log entry so it will not be saved to the database. Rule processing continues for the entry, but it is not stored. Useful for filtering out high-volume irrelevant log noise.
Stop Processing RulesStops further rule processing for the current log entry. No additional rules will be evaluated after this action fires.
Create EventGenerates a Cloudmon event based on the log entry to highlight or track a significant occurrence for future reference.
Raise AlarmsTriggers an alarm whenever the rule conditions are met, enabling real-time alerting for critical issues or anomalies detected in log data.
Notify Third Party ServicesForwards the matched log entry to a configured third-party integration such as Slack, Teams, or an ITSM tool, so log-driven notifications reach the same channels as alarms.