Send Emails
Send Emails turns matching syslog messages into outbound email. It is the Syslog Watcher 7 replacement for the old “email alerts in Server Configuration” model: each mail pipeline is a feature, with its own filter and rules.
| The feature reads messages from syslog storage, not from the collector as they arrive. The collector keeps writing to storage even if this feature is slow, suspended, or failing — storage acts as a large buffer so collection is not blocked. |
Common Feature, Data Fields, and Filter settings are described in Managing Features. Put coarse constraints (severity, originators) on the feature filter; put per-alert logic on the email rules below.
| A message must pass the feature filter before a rule Filter is evaluated. |
Live status is on the Server tab with the other features.
Email Configuration
| Setting | Description |
|---|---|
Email account |
SMTP account defined in Server Configuration. Required. If the list says No email accounts, create an account first. |
Send to |
Recipients, comma- or semicolon-separated.
Plain addresses ( |
Emails (Rules)
Each Email is a rule: optional extra filter + subject + body. Click Add Email.
| Setting | Description |
|---|---|
Name |
A meaningful name for this email (for example |
Filter |
Extra expression for this rule. Blank = all messages that already passed the feature filter (ALL MESSAGES). |
Subject |
Format string for the email subject. Example: |
Body |
Format string for the email content. Example: |
One syslog message can match several rules. Matching alerts from that message go into the same email (and can exceed Maximum merged emails for that one message).
Consolidation
| Setting | Description |
|---|---|
Consolidation |
Off: one email per alert (only with a single email rule). On: merge multiple alerts into one email — required when there are two or more rules. |
Maximum merged emails |
Cap on alerts combined into one outbound email (across messages). A single message that hits several rules can still overflow this cap. |
Email subject (consolidated) |
Subject when several alerts are merged.
Example: Leave blank: the first alert’s subject in the batch is used as the subject of the whole email. |
Delay between emails |
Minimum seconds between sends. Limits load on the mail server. 0 = no delay. |
Filters and Rules
One Feature or Several
One Send Emails feature is enough for most cases. Add another feature for a different Send to address, or to suspend one pipeline without changing the others.
Narrow the Feature Filter
Put severity and originators on the feature filter first.
Those predicates use storage indexes.
Keep expensive tests such as {MESSAGE} CONTAINS ... on the rule Filter, after the feature has already narrowed the set.
Combine Rules That Send the Same Text
If two rules produce the same subject and body, use one rule and combine the filters.
For example, these two filters:
{MSGID} = "LINK-3-UPDOWN"
{MSGID} = "LINK-3-TOOSMALL"
can be one rule:
{MSGID} = "LINK-3-UPDOWN" or {MSGID} = "LINK-3-TOOSMALL"
Use Filter Lists
When a rule filter compares a field to many values, a filter list is easier to maintain and faster than a long or chain.
Example: {MSGID} IN "link_events"
Troubleshooting
If mail does not arrive:
-
Test the email account from Server Configuration to confirm Syslog Watcher Server can send.
-
Check the feature: Active is on, it is not suspended, Email account and Send to are set, and there is at least one Email.
-
Copy the feature filter (section menu on Filter) and apply it in a message view for a time range that should contain matching traffic. Confirm the view shows the target messages.
-
If those checks pass, contact technical support with the details and a support data file.