Purpose
This guide explains how to forward Dell OpenManage Enterprise (OME) alerts to Logsign USO via syslog. OME is Dell's console for monitoring and managing PowerEdge servers, chassis, storage and network devices. It can forward the alerts it receives from managed devices, including its own audit events such as failed console logins, to an external syslog server.
Prerequisites
- An OME account with administrator privileges, which is required to change alert and syslog settings.
- Network connectivity from the OME appliance to the Logsign USO collector on your syslog port (UDP/TCP 514 by default).
Step 1: Configure Syslog Forwarding on OpenManage Enterprise
Menu names can differ slightly between OME releases. If a path below does not match your console, check the OpenManage Enterprise User's Guide for your version.
- Log in to the OME web console.
- Go to Application Settings > Alerts > Syslog Configuration.
- Enable a server entry, enter the IP address or hostname of the Logsign USO collector, set the protocol and port, and click Apply.
- Go to Alerts > Alert Policies and create or edit a policy that uses the Syslog action. Select the device groups, categories (for example System Health and Audit) and severities you want to send. The syslog destination on its own does not forward anything; alerts are sent through the policies that use it.
Step 2: Add the Data Source in Logsign USO
- Add a new syslog source in Logsign USO for the IP address of the OME appliance.
- Select Dell as the vendor and OpenManage as the product.
Supported Message Formats
Logsign parses the standard OME alert message, which looks like this:
1 2026-09-06T10:00:17.887030+00:00 ome EEMI@1___ 2298 - - System Health event from device with { IP } 10.1.2.20 { HostName } null { Severity } Critical { MessageID } CDEV6131 { Message } ... { Recommended Action } ...
Both the RFC 5424 form shown above (version number, EEMI@... application name and the PROCID, MSGID and structured data fields) and the older form without these header fields are accepted. Timestamps can end with Z or a UTC offset, with or without fractional seconds. Any alert category is accepted, so System Health, Audit and other OME categories are all parsed.
What Gets Collected
| Logsign Field | Content |
|---|---|
| Time.Generated | Timestamp of the syslog message |
| Source.Host | Host name of the OME appliance from the syslog header |
| Source.Interface | Application name (EEMI) |
| Event.Type | OME alert category, for example System Health or Audit
|
| Source.IP | IP address of the device that raised the alert |
| Source.HostName | Host name of that device. Left empty when OME reports null. |
| Severity.Name | Alert severity, for example Critical or Warning |
| Message.ID | Dell message ID, for example CDEV6131 or CUSR1219
|
| Event.Description | Alert message text |
| Event.RecommendedAction | Recommended action text from OME |
Every event is recorded with Vendor Dell, Product OpenManage, EventSource Type Storage System and Category Storage. All events are classified under the EventMap System / Service / Info.
Notes and Limits
- Audit events such as failed console logins (
CUSR1219) are also classified as System / Service / Info. The user name and the remote address appear inside Event.Description and are not extracted into separate fields, so filter on Message.ID when you build searches or alerts for these events. - Only the standard OME alert message is parsed. A message must contain the
{ IP },{ HostName },{ Severity },{ MessageID },{ Message }and{ Recommended Action }parts, and the device IP must be an IPv4 address. Messages that do not follow this layout are shown as uncategorized. - Each alert must arrive as a single syslog message on a single line. If two alerts arrive in one message, or an alert is split across lines, the affected lines are shown as uncategorized.