Hello
Im fairly new to solarwinds RTCD so excuse me if this is a simple fix but we have successfully configured our Cisco ASA's and Catalyst 3850 switches to send their RTCD updates to our Orion Server. I am not having issues with triggering the alert when when a change is made, but instead I am experiencing an issue with the email formating. I am using the HTML format option that can be found the in NCM RTCD settings as well as the RTCD logging. When we make a change to a device the email notification is saying the change was made by a different user than the one shown in the syslog message. The username we get is shown as " RealtimeNotification" , this is not a username that we use to log into our switches and it is confusing why it is appearing on these emails when the syslog messages have the correct user names being recorded.
We currently are using the standard NCM change detection rule for our Catalyst 3850 switches which is functional. For the ASA's we are using a rule based on the syslog messages ASA-5-111008 & ASA-5-111010. if the message is found it will
then execute the following external program:
C:\Program Files (x86)\SolarWinds\Orion\SolarWinds.NCM.RTNForwarder.exe ${IP_Address},RealtimeNotification,${DateTime},${Message}
I have checked several kb's and thwack articles and looked into how RTCD gets the username information from the syslog messages but came up empty handed. I believe it maybe an issue with how the syslog message data is carried over/included in ${Message} Macro at the end of the execute external program action for the alert action but that is a hypothesis.
Has anyone else experienced this issue and found a resoultion?
Can any confirm this information is correct or shed some light to how RTCD accomplishes including the username information in the email notifications?
Any help would be beneficial.
Thanks you!
