Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

Orion Syslog Load

I'm curious how Syslogging to Orion NPM will affect the performance. I'm playing with some Syslog setups right now but our current primary Syslog is an older Kiwi setup.

I operate on a fairly large network and have an main application and a second poller. Will syslogging affect the number of elements I can monitor.

What are your thoughts?

Find more posts tagged with

Accepted answers

All comments

byrona

Well, I have a bit of experience with this and I will attempt to summarize it...

We have a fairly large network with a lot of syslogs and we send a good deal of these into Orion.

Large quantities of syslogs coming into Orion don't seem to cause a huge performance hit except for database I/O.
Poorly structured syslog alerts combined with large quantities of syslogs will cause huge performance problems for the system processing the alerts (the destination syslog server)
Large quantities of syslog alert rules combined with large quantities of syslogs will cause performance problems on the system processing the alerts (the destination syslog server)
Storing large quantities of syslogs in the database will cause performance problems for your entire Orion implementation because it's impacting the database

My ultimate conclusions are as follows...

Only use Orion for alerting on the syslogs you need alerts for
Don't use Orion for a syslog archive, set it for short retention of syslogs only; Orion isn't designed for syslog archiving, consider other applications for this such as Kiwi Syslog
Be careful on how you structure your syslog alert rules
- Your first few rules should be to stop processing and delete any syslogs that you don't need (ie. Informational level logs assuming you send those to Orion)
- Have logs be processed against as few alert rules as possible to keep load down
- Rules are processed in the order in which they appear so keep this in mind when setting up your rules

These are my experiences and the conclusions that I have come to.

Hope this helps!

njoylif

great info byrona...I've been fighting this for a while. I have all of my polling on "additional engines" and use the main NPM for SNMP traps and syslog, as well as all the other inherent stuff that comes with being the main engine. I will try to switch it around so syslogging is on another engine and see if that helps. thanks!