Metasys system use of Syslog packet format - Metasys - LIT-12011279 - General System Information - Metasys System - 10.1

Network and IT Guidance Technical Bulletin

Brand
Metasys
Product name
Metasys System
Document type
Technical Bulletin
Document number
LIT-12011279
Version
10.1
Revision date
2019-12-20
Language
English

A Syslog UPD packet contains three fields: PRI, Header, and Message.

PRI Field

The PRI field represents the two Syslog values named Facility and Severity. The Metasys system maps its messages into Syslog Facility and Severity numeric values as described in this section.

All Metasys Audit entries are sent to Syslog setting Facility to 13 (log audit) and Severity 6 (Informational).

All Metasys Events are sent at Severity 4 (Warning).

Metasys Events sent to Syslog reflect the Event Priority in the Facility part of the Syslog packet PRI field to align with the Event Notification Priority as described in Appendix M, Table M-1 of the ANSI/ASHRAE Standard 135-2012 (BACnet®), and map as follows:

Table 1. Syslog Event Facilities
Metasys Event Priority (sent to Syslog with): Facility set to:
00 - 31 16 (Local use 0)
32 - 63 17 (Local use 1)
64 - 95 18 (Local use 2)
96 - 127 19 (Local use 3)
128 - 191 20 (Local use 4)
192 - 255 21 (Local use 5)

These BACnet ranges do not align with the Event Priority Tables 80–83 in Metasys SMP Help (LIT-1201793). Metasys message groups conform to an earlier BACnet standard.

Event acknowledgments are sent to Syslog with Facility 1 (User-level messages), and Severity 5 (Notice).

Header Field

The header field sets the Hostname to the configured COMPUTER_NAME attribute of the NAE551S-2 device object.

Message Field

All Metasys system initiated Syslog messages set the Tag (first part) of the Message portion to Metasys. The content of the audit and event follows the tag, and each is described in the preceding section.

Refer to your Syslog server documentation for further information on how it displays information compliant with RFC3164.

Note: When events are locally discarded in the Metasys system, the Event is internally acknowledged prior to being discarded. However, neither the discard nor the associated acknowledgment are sent to the Syslog server. This is standard Metasys system operation.