So I got this to work finally.
the MAS generates the following syslog message
Dec 17 17:43:29 :217002: <WARN> |l3m| Vlan interface _aruba-vpn link state down
I then made sure my MAS was sending syslog message to my Airwave by typing
conf t
logging <Airwave_IP>
exit
wr me
On Airwave, in System -> Syslog & traps, if I filter by my device or just search for
_aruba-vpn
You will see the following:
At this point you create a trigger that matches the device event with the contents of the syslog message and send an email to yourself.
You then get the alert in Airwave
You will then receive the email as well:
Device Event: Event Contents matches Vlan interface _aruba-vpn link state down and Event Type is Syslog
Severity: Critical
Time: Thu Dec 17 17:45:17 2015
Notes: VPN DOWN!!!!
Device: HON-ON-MAR-00001-SW1 - https://wlan-aw-1.c6.dv/ap_monitoring?id=15421
Group: Canada
Folder: Top > Canada > HON-ON-MAR-00001 > Switch
Location:
Alert Time: 2015-12-17T17:45:16-05:00
Message: Dec 17 17:43:29 HON-ON-MAR-00001-SW1:PRI-0 l3m[1567]: <217002> <WARN> |l3m| Vlan interface _aruba-vpn link state down
Bingo Bango