Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

Syslog in NPM

We own NPM and have tried to use the SYSLOG component will little success. Frist, the included syslog appears to be just free version of Kiwi. We are subject to PCI and need to store a large amount of syslog data and beable to search it for audit purposes. Second, we have had no success in getting our Juniper Firewalls (NetScreen OS and Junos) to send syslog to NPM. The Junipers are confiogured correctly to send to NPM but NPM is not seeing the traffic. Lastly, is NPM really the proper place for syslog from mulitvendors including Cisco (routers, switches FWSM, ASA), Juniper, and ESXi or is the LEM tool really what we want. Tfor the input.

Find more posts tagged with

Accepted answers

All comments

byrona

You definitely don't want to use the Syslog functionality included in NPM for this as it's only designed for alerting purposes, not long term retention. I wouldn't classify it as a log management system at all.

Depending on your specific requirements (different companies have interpreted PCI more strictly than others) you may be able to get away with a dedicated Kiwi system; however, I would strongly recommend LEM for this.

njoylif

ditto byrona, we went through the same issues and ended up with a linux based syslog server with a LEM agent on it to send to the LEM system. I initially tried sending everything to LEM, but that choked up pretty quickly with all the firewall stuff going to it. This was SW supports recommendation on 2 occasions (adding resources being my choice the first time - still got too queued up).

byrona

Larry

Sorry if I misunderstood...

In the case where you were overwhelming the LEM system, what was the specific suggestion of SolarWinds support?

Also, do you remember how many logs per second you were sending to LEM that was overwhelming it? Are these limitations of the system documented because I would really be interested in knowing what they are.

Thanks in advance for any additional information you can provide as I am just getting started with LEM!

njoylif

no worries; they said to offload the syslog collector and put an agent on that server. This would reduce the overhead on the LEM, give you your raw logging retention for compliance (if a concern) and allow LEM to only get in the "massaged" alerting info or whatever subset of info it gets.

I'm waiting for our syslog server to be built before I can say how well it does, but I think I'll get it this week.

I typically get between 20 and 30GB per day because of the firewalls and our requirements for logging levels.