Changing top 20 hosts

I use Kiwi syslogd v8.0.2. The top 20 hosts in the daily statistics email and the Syslog Statistics dialog are not really the top 20 hosts. Typically they represent less than 10% of usage, with the remaining 90+% relegated to the "All others" row. How can I either manually select others or reset whatever criteria Kiwi is using to dynamically select them so I can see the activity on my most active sources?

-evan

Find more posts tagged with

top_talkers

kiwi_syslog_server

syslog

kiwi_syslog

syslog_daemon

Accepted answers

Kuz

Interesting...

That was more or less the breakdown I was expecting to see - except for the (75) bit
Can I ask what version of Kiwi Syslog you're using? We have had problems with accuracy of the stats reporting in older versions...

Whatever the case, if you employ a custom Top 'N' Report then you can track (and report on) as many hosts as you like.

-Mike.

All comments

Kuz

Hi Evan,

The Top 20 hosts report will show you the 20 device with the most activity. The "All Others" is a sum of all the remaining devices.

If for instance you had 200 devices, each sending roughly the same syslog throughput, then you can expect to see the top 20 devices account for ~10% of total traffic. The remaining 180 devices account for the remainder, slightly less than 90%.

If a Top 20 isn't enough, we do provide a Top 'N' script-based report. Not sure it will help in your situation though.

Check out this from the Kiwi Syslog Content Exchange:

Top N Hosts Report: Pt1: and Pt2:

evanb

Here's an example from today's statistics email:

Top 20 Hosts	Messages	Percentage
xx.xx.xx.xx	1	0.09%
xx.xx.xx.xx	1	0.09%
xx.xx.xx.xx	1	0.09%
xx.xx.xx.xx	1	0.09%
xx.xx.xx.xx	1	0.09%
xx.xx.xx.xx	1	0.09%
xx.xx.xx.xx	1	0.09%
xx.xx.xx.xx	1	0.09%
xx.xx.xx.xx	1	0.09%
xx.xx.xx.xx	1	0.09%
xx.xx.xx.xx	1	0.09%
xx.xx.xx.xx	1	0.09%
xx.xx.xx.xx	1	0.09%
xx.xx.xx.xx	1	0.09%
xx.xx.xx.xx	1	0.09%
xx.xx.xx.xx	1	0.09%
xx.xx.xx.xx	4	0.35%
xx.xx.xx.xx	21	1.85%
xx.xx.xx.xx	31	2.73%
All others (75)	1060	93.47%

There are 75 "others" and their average number of messages each is 1060/75 ~= 14. I would think some of them should be in the top 20 in place of those that have only reported one message each.

I will have a look at the top 'N' script. I am curious to see your take on the above, though.

Kuz

Interesting...

Whatever the case, if you employ a custom Top 'N' Report then you can track (and report on) as many hosts as you like.

-Mike.

Kuz

Just noticed you're using 8.0.2...

There were a couple of stats and Top 20 hosts report accounting fixes in 8.1.9 and 8.2.1.

I'd highly recommend getting the latest version (9.1)