Here are a few of my Cacti alerts. I’m definitely a network guy, so you will mostly see network related alerts. If you have any you want to share with the world, add them to the comments!<\/p>\n
!!Start with a few Mikrotik alerts: sys error, accepted a DHCP address and failed login\r\nNAME\t\t\t\tTYPE\t\t\t TEXT\r\nMikrotik System error\t\tMessage Begins with \t system,error,critical\r\nMikrotik Rogue - DHCP Client\tMessage Contains \t dhcp,info,debug dhcp-client%got ip address\r\nMikrotik incorrect login\tMessage Contains \t system,error,critical login failure for user %from %\r\n!!A lot of Cisco alerts. Some of these, such as the POS interface may or may not apply to you :)\r\nCisco BGP adjchange\t\tMessage Contains \t BGP-\r\nCisco dup address\t\tMessage Contains \t Duplicate address \r\nCisco Serial Interface\t\tMessage Contains \t Interface Serial\r\nCisco POS interfaces\t\tMessage Contains \t LINEPROTO-5-UPDOWN: Line protocol on Interface POS\r\nCisco hsrp\t\t\tMessage Contains \t HSRP-\r\nCisco OSPF Alert\t\tMessage Contains \t OSPF- \r\nCisco MPLS Neighbor Change\tMessage Contains \t LDP-\r\nCisco MPLS\t\t\tMessage Contains \t cdt%mpls\r\nCisco Duplex Mismatch\t\tMessage Contains \t CDP-%-DUPLEX_MISMATCH\r\nCisco err-disable\t\tMessage Contains \t err-disable\r\nCisco Spanntree\t\t\tMessage Contains \t SPANTREE\r\nCisco FIB TCAM error\t\tMessage Contains \t fib tcam\r\nCisco Power Failure\t\tMessage Contains \t power%supply%fail \r\nCisco Fan\t\t\tMessage Contains \t BLOWER%fan%fail\r\nCisco Voltage\t\t\tMessage Contains \t ENV%Voltage measured\r\nCisco Late Collision\t\tMessage Contains \t \\%PM_SCP-SP%late%collision\r\nCisco RSP\t\t\tMessage Contains \t %RSP\r\nCisco LACP\t\t\tMessage Contains \t \\%EC%LACP\r\nCisco Controller\t\tMessage Contains \t \\%CONTROLLER-\r\n!!User trying to login to your ASA via VPN failed authentication\r\nASA failed vpn user\t\tMessage Contains \t %ASA%Remote peer has failed user authentication\r\n!!Someone logging into your centos box via root\r\nCentos logon as root\t\tMessage Contains \t Accepted password for root<\/code><\/pre>\n