@fritzah wrote:
I have tried using using custom syslog to alarm but the alarms are being processed by IMC 6 hours after the switch sends the log.
That doesn't sound right at all. Something else is going on if it's taking your system 6 hours to process a syslog -> alarm rule.
Do you see the syslog show up on IMC straight away? Or does it not even show up in all syslogs for 6 hours?