Empty severity when generating a syslog event using REST

[Legacy User]

Hello,

 

I need to generate a syslog event (0x21001c) using the Spectrum Restful Webservices.

I have successfully generated an event using the examples in spectrum/RestfulExamples/xml/Events but if I use the following xml file, the syslog severity in the event is empty :

 

<?xml version="1.0" encoding="UTF-8"?>

<rs:event-request throttlesize="10" xmlns:rs="http://www.ca.com/spectrum/restful/schema/request" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.ca.com/spectrum/restful/schema/request ../../../xsd/Request.xsd">

 

<rs:event>

    <rs:target-models>

        <rs:model mh="0x102c11"/>

    </rs:target-models>

 

    <rs:event-type id="0x21001c"/>
    <!-- attributes/varbinds -->
    <rs:varbind id="1">FWM</rs:varbind>
    <rs:varbind id="2">2</rs:varbind>
    <rs:varbind id="3">STM_LOOP_DETECT</rs:varbind>
    <rs:varbind id="4">message</rs:varbind>

 

</rs:event>
</rs:event-request>

 

 

When I send the POST request, the syslog severity is empty in the event.

I have the event message "%FWM--STM_LOOP_DETECT: message"

while I expect to have "%FWM-2-STM_LOOP_DETECT: message"

 

In the event configuration, I know that the type of the variable 2 is a match table as below :

 

%{S 1}-{T T1_210017 2}-{S 3}: {S 4}.

 

If I check in the definition file for T1_210017 (in spectrum/SG-Support/CsEvFormat/EventTables/T1_210017_en_US), I see :

 

0x00000001 0
0x00000002 1
0x00000003 2
0x00000004 3
0x00000005 4
0x00000006 5
0x00000007 6
0x00000008 7

 

My question is : Is there a specific syntax in the XML file to use a variable for which the type is a match table  ?

Or can someone explain why the severity is empty in my event ?

 

I've tried to use this :

<rs:varbind id="2">0x00000003</rs:varbind>

or

<rs:varbind id="2">00000003</rs:varbind>

but the severity in the event message is still empty.

[Legacy User]

Hi, Have You created that Event-Table by Your own? If yes, - have You relouded the Event-Configuration in Spectroserver/Oneclick? ... perhaps a very basic question but that problem causes the most bugs in Event-Proecssing.

[Legacy User]

Hi Erich,

This is the default table for syslog events (in SG-Support directory, not in custom).

In fact as a workaround, I could create a new event which would not use EventTable format variable but if possible I would like to use this one.