opHA can send syslogs using escalation or send syslogs at the same time as the events are logged to the local file, which is basically realtime, this bypasses using the escalation system.
We need to make sure the Master is setup to receive logs, the following documentation is for rsyslog.
Edit the rsyslog config /etc/rsyslog.conf, make sure it is willing to accept logs, and that the facility used above is going into the slave_event_log
Now make sure rsyslog is running.
Now configure NMIS pollers to send their logs through syslog to your master server. To run events through syslog check this config setting:
'syslog_events' => 'true'
Then make sure the config has the correct settings for the Master syslog service, specifically make sure the syslog_server points to the correct host, proto and port:
To run Escalations on events before syslog:
To run events through escalations before putting them into syslog:
'syslog_use_escalation' => 'true'
To have events go directly into syslog without escalations
'syslog_use_escalation' => 'false'
This will use the Common-events model to determine which events should be sent as syslogs, by default all events will be sent, except for some of those events for deleted interfaces, etc.
On the poller run:
On the master you should see the event (in the GUI as well if you refresh)