How long do you keep you Syslog messages for?

Ciag

hi

We have been having some issues with our syslog viewer lately and also with viewing syslog in the web browser. (Issues being that I couldn't view the syslog page in the web browser and the Syslog Viewer on the server kept timing out, even when it was just loading the application).

As far as I can see the trouble started when I increased the length of time Orion retains the syslog msgs for. I increased it from 7 days to 31 days, which is not an overly long time.

 It's worth noting that we have over 2000 devices set up to send syslog to Orion. there is only one instance over the past month that I can think of where an abnormally high amount of syslog messages would have been received. This was from debug info from one of our IPT gateways which sent out nearly 1.5 million msgs within a half our or so.

I'm not sure if the length of time is the actual cause of this problem but I'd be interested to see how others have their server set up.

Alternatively could there be anything I might need to change in the syslog table on the server it's be stored?

 Thanks

lchance

dumb question - where is this 7 day setting? i can't find mine.

i did do an extract into Excel of Syslog events from my NetPerfMon database and I only have seven days worth. my volume is light compared to yours - only 11,000 events in seven days.

looking at the Message ID number in the Excel column it appears we've processed over 400,000 Syslog messages since that first device starting sending Syslogs to Solarwinds.

however, i will soon be adding many more devices to this and would be interested in your solution and also increasing mine to 31 days - even longer would be great to me.