Action - Send ICQ instant message

This feature is only available in the licensed version.

*** This feature is currently disabled because of changes to the ICQ WWW paging system. We aim to have a replacement paging system very soon. ***

This action will send an ICQ instant message to the ICQ number specified whenever a Syslog message is received that matches the filters set.

The alert will appear on ICQ as an incoming WWPager message. The user can then read and close the ICQ alert.

The message is sent via the ICQ web based interface. This is currently a free service. The ICQ client can be downloaded for free from http://www.icq.com.

Delivery of the message is not guaranteed and is performed on a best effort basis. ICQ limits the frequency of pager messages to around 1 every 2 seconds. Pager messages being sent faster than this will probably be lost.

To be able to use this feature, the program must be able to directly connect to the ICQ web server on port 80 using standard http. Transparent proxies are not an issue. This feature will not work via a firewall that blocks direct port 80 access. The destination web site address is http://wwp.icq.com. This address may need to be added to the firewall access list for direct access.

Details from the Syslog message received and other Syslog statistics can be included in the message subject or message body.

ICQ number:

This must be a valid ICQ number to send the page to.

From name:

This can be any descriptive name you like. This name will appear as the Nickname on the ICQ message.

From e-mail address:

This address should be a valid return address. It is shown in the E-mail address field on the ICQ message.

Subject:

This line is used to indicate the subject of the message. Normally this is set to %MsgHost. This will be replaced by the host name of the device that sent the original syslog message.

Other variables can be used in the subject line. Click on the "Insert message content or counter" hyperlink to display the popup menu of available variables. The Max subject length option can be used to ensure that only a limited number of characters are sent in the subject line.

Message:

This is where you place any message text you want to have appear in the ICQ message. Normally this is set to %MsgText. This will be replaced by the message text from the original syslog message.

Other variables can be used in the message body. Click on the "Insert message content or counter" hyperlink to display the popup menu of available variables. The Max message length option can be used to limit the amount of data sent in the message body. If you have used the variable %MsgText in the message body and a large syslog message arrives, it may be too large to send via ICQ. You can limit the message body length to a more manageable length.

Expand <013><010> in message

This option will expand any carriage return and line feed characters that have previously replaced with <013> and <010>. If the replace non printable characters with ASCII value option is set, any CR and LF characters appearing in the syslog message are replaced. It is sometimes useful to have them expanded back again when forwarded via ICQ as it makes the text more readable.

Example pager message:

Below is an indication of what the ICQ pager message will look like.

Nickname: Syslog Server

E-mail: syslog@company.com

Sender IP: xxx.xxx.xxx.xxx

Subject: firewall.company.com

Firewall Alert - Unauthorized login attempt: User=Administrator

The Test button will send a test ICQ pager message to the ICQ number specified. The content of the test message can be modified by pressing the Test Setup button.

Insert message content or counter

To pass program variables, counters, script fields and statistics into the ICQ pager message, click on the Insert message content or counter link and choose an option from the popup menu. More details on the values can be found here.

This option allows you to choose a variable from a popup menu. The variable is then replaced with the current value before the message is sent. For example %MsgText is replaced with the text of the current syslog message. Just position your cursor in the subject or message text lines and click the hyperlink. A popup menu will be displayed so you can choose the variable you want.

Example subject field: Syslog Alert from %MsgHost

Example message body field:

Message from Host %MsgHost at %MsgTime on %MsgDate Message: %MsgText