Skip to main content
Migration Notice
We're migrating documentation from the old portal into this one. Some things may look a little different or out of place in the meantime — we know, and we're working to get it right. If something's unclear or doesn't look right, let us know.
Version: 2.15.0

Monitoring and Alerts

Introduction​

Eyeglass raises alarms for configuration replication errors, failover events, readiness warnings, and appliance conditions. This section covers how to configure notification of these alarms by email and by syslog forwarding, so administrators are notified of DR-relevant events outside of the Eyeglass Web UI.

note

For a reference on the job types, schedules, and alarms associated with configuration replication and failover automation, see Eyeglass Jobs and Job Types.

Configure Email Notifications​

Legacy UI

The steps below describe the legacy Notification Center. In the 2.15.0 GUI, this is Settings (gear icon, top-right of any page) → Notifications, with an SMTP Server table replacing Configure SMTP and an Alarm Recipients table replacing Manage Recipients — see Settings. The Exchange relay guidance and syslog forwarding sections below are unaffected by this navigation change.

Email notification is configured from the Eyeglass Notification Center.

Configure SMTP​

  1. Log in to Eyeglass and open Notification Center.
  2. Open the Configure SMTP tab and enter the following:
    • Host name: the host name of your email server.
    • Port: the port used for sending email.
    • From: the sender email address (for example, alerts@eyeglass.com).
    • Use Authentication: enable if your email server requires an authenticated login, and provide the User and Password.
    • Enable TLS: enable if your email server expects TLS communication.
    • Alarm Severity Filter: the minimum alarm severity you want to receive by email.
  3. Click Test Email Setting to confirm connectivity. A response of no error indicates success; otherwise, review the debug information returned or contact support.
  4. Save your changes.
warning

If Alarm Batching is enabled, the Alarm Severity Filter above is not applied — a batched report includes alarms of every severity, not only those at or above the configured threshold.

Configure Email Recipients​

  1. Open the Notification Center > Manage Recipients tab.
  2. Enter the Email Recipient address that alarm emails should be sent to.
  3. Select the report/notification types this recipient should receive (for example, all alerts, or a specific report type).
  4. Click Add.

Using Microsoft Exchange as the Mail Relay​

When relaying alarm email through Microsoft Exchange, the following points from Superna's Exchange setup guidance apply:

  • Provide the IP address of an Exchange FrontEnd Transport server as the SMTP host.
  • Two supported connector configurations exist:
    • Anonymous relay: TLS disabled on the Receive Connector, with the connector's scope restricted to the Eyeglass appliance IP address so that no authentication is required, but only Eyeglass can relay through it.
    • Authenticated relay: TLS and Basic authentication enabled on the Receive Connector, with an email/password login configured on the Eyeglass side.
  • If a port conflict exists with the default Exchange Receive Connector, use a unique, unused port (for example, port 256) for the Eyeglass-scoped connector.
  • If the Exchange server logs a certificate_unknown(46) error, this indicates a TLS negotiation failure; disable TLS on Eyeglass and retest.
tip

Use the Test Email Setting button in Notification Center after any relay change to confirm delivery before relying on it for production alarms.

Configure Alarm Forwarding by Syslog​

For environments that forward alarms to an external syslog server or SIEM, Eyeglass supports syslog-based alarm forwarding with filtering by severity, application, or specific alarm code.

warning

SNMP alarm forwarding has been deprecated as of release 2.5.8.1. Syslog, email, and REST API are the supported alarm forwarding and integration methods going forward.

Configuration Steps​

  1. SSH to the Eyeglass appliance as admin, then switch to root:

    sudo -s

  2. Edit the syslog-ng configuration file:

    nano /etc/syslog-ng/conf.d/superna.conf

  3. Check the installed syslog-ng version, and use it for the @version line in the config file:

    syslog-ng --version

  4. Add a filter, source, destination, and log block. For example, to forward all DR ("SCA")-prefixed alarms to a syslog server at x.x.x.x:

    @version: 3.29

    filter f_superna {
        message("SCA") ;
    };

    source igls_src { file("/opt/superna/sca/logs/igls_alarms.log"); };
    destination logserver { udp("x.x.x.x" port(514)); };

    log {
        source(igls_src);
        filter(f_superna);
        destination(logserver);
    };

  5. Restart syslog-ng for the changes to take effect:

    systemctl restart syslog-ng

  6. Confirm the service is active:

    systemctl status syslog-ng

Filtering Alarms​

  • By severity, for example:

    filter f_superna {
        message("Severity:CRITICAL") or message("Severity:MAJOR") ;
    };

  • By alarm code (recommended and supported method) — see the Alarm Codes reference for the full list of codes.

  • By application prefix — each Eyeglass application uses a distinct alarm code prefix. For DR, the prefix is SCA.

Example Forwarded Alarm Format​

Eyeglass syslog messages are based on entries in /opt/superna/sca/logs/igls_alarms.log and use a comma-separated format. A DR failover alarm, for example, includes the failover status, start/finish timestamps, a link to the failover log, and the alarm category:

[DEBUG] IGLS_ALARMS:168 - Eyeglass, , Event: 2023-04-27 22:44:34.25, AID:DFS Policy Failover 2023-04-27_22-40-01, Port:Nil, Type:null, EntityType:, Extra Data:{"Status":"Success", Finished:1682649874241, Started:1682649601989, URL:"https://172.25.22.42/failover_logs/..."}, Description:Failover Succeeded, NSA, Severity:INFORMATIONAL, Impact:false, Category:SCA0040

Troubleshooting Syslog Forwarding​

  1. Enable verbose logging:

    syslog-ng-ctl verbose --set=on

  2. Check forwarding statistics for the configured destination label:

    syslog-ng-ctl stats | grep logserver

    If the counters remain at zero, no messages have matched your filter.

  3. Generate a test alarm to validate the pipeline:

    igls test AlarmTest

  4. Re-check the stats command, and confirm the message is received on your syslog server.

See Also​

Eyeglass Jobs

Understand how Eyeglass jobs work, including types, modes, and scheduling options.

See More

Integration Guide

Learn how DR alarm forwarding integrates with external SIEM and monitoring systems, and how the DR API can be used for automation.

See More

Alarm Batching

Consolidate high-volume alarm notifications into periodic batch emails at the portal level, reducing alert fatigue while preserving critical alerts.

See More

RPO Trending and Reporting

Configure scheduled compliance reports that track SyncIQ RPO against per-cluster targets, separate from the alarm delivery covered on this page.

See More