Log Forwarder 1.1v

FormerMember

Hello ,

I have a question about the logforwarder.exe process

After installing & configuring the Log Forwarder

once a new log is written the log forwarder sends it through syslog to the kiwi server,

1.Where are the logs stored before they are send to the kiwi server

2. In a case were the kiwi syslog isn't responding , whefre are the logs stored until they are sent to the kiwi syslog

3. How much memory can logforwarder.exe take , when the log ratio is very hight

Thank you for your help

Find more posts tagged with

forwarder

log

log_forwader

log_forwarder

kiwi

Accepted answers

All comments

bshopp

#1 they are processed in real-time so they are not stored anywhere

#2 Syslog uses UDP which by definition is not guaranteed delivery. If the Syslog Server is not responding, it does not attempt to re-transmit or queue them up or anything like that, they are essentially dropped.

#3 I don't have any data on this, as this can be extremely variable depending on the box (memory, processors), what else is installed on that machine, what event logs you are watching, the volume of event logs etc.

FormerMember

I am auditing exchange securtiy mail box audit , the event log volume is about 2 gigb log , the box is a server with around 32gb memory.
The logforwarder.exe process spickes to 10mb and stays between 10-11mb , with this i have no problem ,but i am afraid it will crush the system at some point ,

Can the process memory get higher with the number of logs ratio per second is very high , after 2 mintues of runing is stays around 11-10mb ,
When the event logger doesnt log the process is around 5mb

bshopp

Are you forwarding all logs from the exchange security mail box audit? Do you have any rule or filters defined on that log as to which to forward over to the Kiwi Syslog server? Do you expect the volume of this log to grow a large amount over time?

FormerMember

bshopp ,

I am forwarding only audit logs, yes , i will build a filter rule in the near future, the log wouldn't probably get lower but will stay steady