Method to reduce Real Time Change Notification syslog traffic

Hello All,

I recently tried to implement RTCN using the recommended commands in the NCM Administrator Guide and realized that some tweaking is required to reduce the amount of level 6 syslog messages that is sent to SolarWinds.  The following is one way that, with the help of sean.martinez, that I found appears to reduce the syslogs generated to just the messages NCM is looking for to trigger the RTCN job.

Configure Configuration Change Notification and Logging

     enable
     configure terminal
     archive
     log config
     logging enable
     logging size entries
     hidekeys
     notify syslog
     end

Now create a discriminator using regular expressions that allows only the“Configured from console” messages to be sent to SolarWinds…

     logging discriminator LOGTHIS msg-body includes ^Configured

Now apply that discriminator to the desired syslog destination

     logging host X.X.X.X discriminator LOGTHIS

I am posting this for anyone else looking for a way to reduce the sylog traffic generated by RTCN.

hope this helps!

-jc