Using the Syslog Monitor

1. Go to the Passive Monitor Library:
   • From the web interface, click GO. The GO menu appears.
   • If the WhatsUp section is not visible, click WhatsUp. The WhatsUp section of the GO menu appears.
   • Select Configure > Passive Monitor Library.

     - or -

     From the main menu of the console, select Configure > Passive Monitor Library.

2. In the Passive Monitor Library, do one of the following:
   • Click New. The Select Passive Monitor Type dialog appears.
   • Select Syslog from the list, then click OK. The Syslog Passive Monitor Instance dialog appears.

     - or -

   • Select an existing Syslog from the list, then click Edit. The monitor properties dialog appears.
3. Enter or select the appropriate information in the following fields.
   • Name. The name of the monitor as it appears in the Passive Monitor Library.
   • Description. The description of the monitor as it appears in the Passive Monitor Library.
   • Match on. Click Add to view the Expression Editor where you can create an expression, test it, and compare it to potential payloads. After creating an expression, click OK to insert that string into this list.

   Note: If you have multiple payload Match On expressions, they are linked by OR logic, not AND logic. If you have two expressions, one set to "AB" and the other to "BA", it will match against a trap containing any of the following: "AB" or "BA" or "ABBA". For more information, see the Regular Expression syntax topic.

   Tip: Select an expression from the list to Edit it or Remove it from the list.

4. Click OK to save changes.