Syslog Correlation Engine

Correlate syslog events across 100s of devices to detect cascading failures, identify root-cause vs symptom events, compute blast radius, and auto-generate incident timelines.

Multi-vendor (syslog input)

Cisco

Juniper

Any RFC5424

Open in Generator Open in Platform

You're viewing a preview

The full script, parameters, and execution console are available with a free account.

Already have access? Sign in →

Capabilities

Multi-device event correlation
Root cause vs symptom scoring
Cascading failure detection
Blast radius calculator
Auto incident timeline
Pattern-based severity classifier
Regex rule engine (YAML config)

Required inputs

Parameters the script accepts. Defaults shown; some are vendor- or context-gated.

Parameter	Type	Default	Notes
Syslog directory / file syslog_dir	string	./syslogs/	—
Correlation window (mins) time_window_mins	number	15	—
Min severity (0-7) min_severity	number	3	—
Rules file (.yaml) correlation_rules	string	rules.yaml	—

Hint 1 — Name your vendors and OS versions

Mention the exact platforms you run (Multi-vendor (syslog input), Cisco, Juniper, …) so the generated analysis logic uses the right CLI/NETCONF syntax.

Hint 2 — State your real thresholds

Provide concrete values for Syslog directory / file, Correlation window (mins), Min severity (0-7) instead of the defaults — they shape what counts as a fault.

Hint 3 — Prioritize the checks you need

This tool can multi-device event correlation and root cause vs symptom scoring. Ask for the subset relevant to your incident to keep output focused.

Hint 4 — Describe your inventory format

Tell the assistant whether your device list is CSV, YAML, or JSON and which columns it has, so parsing matches your data.

Sample inventory schema

Authoritative shape of the device/policy data this script consumes.

sources.yaml

yaml

Multi-source ingest: rsyslog HA pair, SNMP trapd, Kafka events

yaml

# Syslog/event sources fanned in by the correlator
sources:
  - name: rsyslog-primary
    transport: tcp

rules.yaml

yaml

Correlation rules with thresholds, group-by keys, and actions

yaml

# Multi-line correlation rules (firing → action)
rules:
  - id: bgp_flap_storm
    match_any:

Expected output

Reference terminal output the script should produce — used as a stylistic and structural target.

terminal

[14:55:00] Parsing 2.4M syslog events from 47 devices (last 4 hours)...

INCIDENT CORRELATION REPORT
━━━━━━━━━━━━━━━━━━━━━━━━━━━
Incident #1 — CRITICAL — Started 14:23:47
  Root Cause:  core-sw-01 "LINK-3-UPDOWN: Interface Gi0/1, changed to down"
  Cascading:   → 3 downstream switches lost uplink
               → 847 hosts lost connectivity (blast radius: VLAN 10, 20, 100)
               → 12 BGP sessions reset (hold timer expired)
               → OSPF reconvergence triggered on 5 routers