Hi, I am filtering out all but config syslog messages from our CISCO device so if a config change happens then we get a handful of messages only so the volume is tiny, but I cant get PRTG to react to them. The code I want to trigger the down notification is on the message containing 111008 . If I use a syslog receiver to check that the messages are actually coming out of the system they appear as expected and the string is present in the message of the record so I dont understand why I'm not seeing the behaviour I expect, unless I am missing how this works. If I put the string to search for in the entry for it not being present then even if no syslog records have been sent then it triggers the notification.
Any help would be appreciated as this may prove very useful in our PCI compliance solution.