Dashboard Events disappear

Miso76

Hello,

we are using the Event Log forwarder to forward the Windows Event logs.

It is working but after some hour they disappear from the Kiwi Dashboard rsp. Events with Filter to the related Server.
In the Logfiles the entries are present but not in the DIsplay anymore
Looks like the Display will be cleaned up.
Is there a setting which keep the Events longer in the Dashboard / Display ?

Kiwi Logserver 1.5 NG Trial Version

Edit: May it is this option

Maximum events to batch up before sending to log file

Thank you.

Best Regards

Michael

jeremymayfield

Yes, the behavior you're seeing in Kiwi Syslog Server NG 1.5 (trial version) is expected and tied to how the Dashboard (specifically the Events widget/table) works in KSS NG.

The Dashboard's Events section displays a live, in-memory or buffered view of recent messages (including those forwarded via the Windows Event Log Forwarder). This is not the full historical log storage. It's a temporary display buffer designed for real-time monitoring. Once the buffer reaches its limit (based on message volume or internal thresholds), older events are automatically purged from the view to make room for new ones. That's why messages disappear from the Dashboard/Events tab after some hours, even though they're still safely written to disk in the log files (e.g., under the configured log directory, often split by host/date).

• The actual logs on disk (txt, csv, or database if configured) remain intact indefinitely (or until archived/deleted via schedules).
• The Dashboard/Events view is intentionally short-term and does not have a user-configurable retention period like historical log files do.
• This differs from the legacy Kiwi Syslog Server, where console views had more adjustable buffer sizes.

Regarding the Maximum events to batch up before sending to log file question, no, this setting (if it exists or you're referring to a similar batch/flush option) affects disk logging performance how many events are queued in memory before flushing to the log file. It helps with high-volume scenarios to reduce I/O overhead, but it does not control how long events stay visible in the Dashboard. Increasing batch size might slightly delay when messages hit disk, but it won't prevent them from dropping out of the display buffer.