Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials

Monthly maintenance - need to keep syslogs on Cisco ASAs

dbo.dbm_SyslogMessages_DeleteStale table in the NetPerfMon- Database-Programability-Stored Procedures.

Due to regulations, the syslogs on all our Cisco ASAs need to be maintained for one year. Solarwinds deletes old syslogs after 30 days. Is there a SQL query to run that would prevent Cisco ASA syslogs from being deleted until 1 year (or whatever time we want)?

Find more posts tagged with

Accepted answers

All comments

zkahl

If you look under settings -> Polling Settings

You will see an entry "Syslog Messages Retention ". Just change this to "365" days.

Zak Kahl

Loop1 Systems

gregatkins

We knew about that option, there was a SQL query you could run that would exclude ASAs from the maintenance. . We'd prefer not to keep the syslogs on all the devices for 1 year.

zkahl

Got it. Sorry, I misunderstood the question.

I don't know the query. I will be watching to see what the answer is. This solution can be useful for other syslog retention per device(s).

mgibson

I originally had ASA syslog's going to my ORION NPM Database, but because of the performance hit, It was best to use Kiwi Syslog standalone for this. If you ever have a window where something is denied and not taken care of promptly, your ORION DB can grow out of control in seconds or minutes. In my case, we are talking about millions of syslog's per day normally, but 10's of millions when something went terribly wrong.Take a look at your syslog table and compare its size to your overall DB size.

gregatkins

Our database is around 45GB . We have to keep trap and syslogs due to this being a casino and state regulations. We had it setup where all the syslogs would get purged except the ASAs. We're not having any issues with database size. When we set up our new server with new Solarwind installs the query was overwritten . Here is part of it from a document I found, naturally the other half is cut off I'm thinking an exclusion for ASAs on the line DELETE TOP (10000) FROM SysLog WHERE DateTime < @ date would probably do the trick. It looks like the table has changed slightly from previous versions of NPM. I'm hoping on the Solarwind SQL support gurus will get on board and help

Our server barely hiccups under load

Sohail.Bhamani

You should be weary of having massive Syslog and Trap tables in the SW DB. In my experience with many SW customers over the last year as a Field Engineer for Loop1 Systems, it has been shown that having those 2 tables very large will cause slow downs on the web site. If you aren't experiencing this than you are in the minority based on the nearly 40 customers I have worked with this year.

I always share with my customers to use the Orion syslog and traps tables as a place to send your traps to process for alerts and what not but not to be used for long term storage. You will be much better off using something like Kiwi Syslog to store all your syslogs long term. You can have Kiwi forward syslogs to Orion so the Syslog/Trap alerts can be used. Be sure and have Kiwi maintain the source IP of the forwarded syslog/traps if you do so. Also be sure in Orion to set your syslog/trap retention back to the 7 day default. Since the syslog/trap rules are processed top down, create alerts above for the ones you need and then put a discard all rule at the very bottom. This way, the ones which alerts have been generated stay for the retention amount and the rest are dropped from the Orion DB.

This has worked quite well for many of my customers. Kiwi is pretty cheap as well.

Sohail Bhamani

http://www.loop1systems.com

gregatkins

Figured it out...

TOP(10000) FROM SysLog WHERE DateTime < @date AND MessageType NOT LIKE '%ASA'

SELECT @RowCountVar = @ROWCOUNT

SET @CatchCount = 0; --Null catch count