Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

Solarwinds orion database log

Hello all,

we have recently upgraded our solar-winds NPM&SRM hosted in single application server to latest version 2019.4

During upgrade, while running configuration wizard, it was recommended to use separate database for logs, hence at that point we have created a new database instance for that.

Now that database"Solar-winds Orion log" is growing vast. We are running out of drive space. To be frank, we planned to upgrade our modules to 12.5/6.9 but after installation we found it was 2019.4 :-)

Now i am really tensed and confused on how to handle this new database.

I have called solar-winds support to understand what logs are feeded into it, It was syslogs,snmp traps and other logs as a part of log analyzer in 2019.4.

But as per success center articles, i cannot find "log viewer" under dashboards and only i can see "Log and even settings" under Product specific settings. Can i get a clarity that - now we have log analyzer installed automatically with upgrade or any legacy features are given.

Currently we are not using this for analysis.

Can someone kindly help me on how to manage this database. any recommendations to truncate the data , what frequent basis we have to truncate ?

This data should also be backed up?

This should be part of HA?

I am stuck up with all these questions. please help me.

For now i have selected all the nodes and in "more actions" tab, i have disabled "log monitoring"

Changed log retention settings to 1 day

And i explored and created a custom rule in log viewer to discard the logs from all the sources but i am still bothered that whether this will impact my monitoring?? i am attaching screenshots below. Kindly provide your inputs.

* Similar rule i have created for Syslog, Traps, Global Postprocessing also. Please help if this rule will impact any of my performance monitoring and alerting?

Thanks a lot in advance!!!

Find more posts tagged with

Accepted answers

Seashore

One thing to consider is that before upgrade:

* All traps and syslogs also came in as of now

* they where stored in the orion database in the [traps] and [syslog] tables

* as a table grown, so does the database, and it will not shrink in file size as tables are emptied

Now, after upgrade:

* traps and syslogs come in as before

* they are stored in a NEW database

* they new database will take up new disk space

* the old disk space is still occupied by old traps and syslogs

Not having dug into this that deep, just thinking as a DBA, the old tables should be truncated and if the tables where massive (should be about the same size as the new logDB), orion database could possible be shrunken.

Maybe there should be some best practice guides on what to do then migrating to the new database....

All comments

mesverrum

So one thing to consider is that these logs were already being sent to your system in the legacy system, so the performance impact on your server isn't really that different, you used to get these events and they were being dumped on the syslogs/traps tables in the old db. They've just deprecated those syslog/trap tables and moved them to a separate place with a structure that is more performant. If you haven't changed the menu bars then there should be a section with alerts/ events/syslogs/traps/ message center. The shortcuts there should have updated to display the new traps view.

sw22375918

hi,

I would like to understand in solarwinds orion log database, instead of this syslog and trap data- any other data will be feeded?

because our database is growing very fast. what can be done to control it. please help

neomatrix1217

Can you tell me what tables are growing or which are the biggest tables in your database?

sw22375918

It is SolarwindsorionLog.

mesverrum

It holds traps, syslogs, and if you have VMAN it will also collect vmware events. They all get dumped into the same database tables and just get sequenced as they come in and tagged by where they came from. If you made those rules to just discard all events then I expect it should have stopped growing.

sw22375918

So now in log configuration rules I have created custom rule to discard all log entries. Will that helps me..and by that rule, did my any other processes wil get effected like my NPM monitoring and reporting,

sw22375918

We have NPM , NCM , NTA in our environment.

Seashore

One thing to consider is that before upgrade:

* All traps and syslogs also came in as of now

* they where stored in the orion database in the [traps] and [syslog] tables

* as a table grown, so does the database, and it will not shrink in file size as tables are emptied

Now, after upgrade:

* traps and syslogs come in as before

* they are stored in a NEW database

* they new database will take up new disk space

* the old disk space is still occupied by old traps and syslogs

Maybe there should be some best practice guides on what to do then migrating to the new database....

sw22375918

So which means the old syslog and trap data is still in solar winds Orion database and new data is now moving to Solar winds Orion log.Can i ask my database team to delete those old data from solar winds Orion?? and any other best practices can be recommended on this new database?

Seashore

I think so.

Yes please ask your dba-team to take a look at the traps and syslog tables (and trapsvabinds etc). If they have alot of old data it should be ok to delete that.

sw22375918

Seashore Thanks for the suggestion. I will take it forward with my dB team. Appreciate your help.!!