Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials

Trap and Syslog Retention Period

Hello,

I have a request from one of my users to have the traps and syslogs retention period increased from the default period in place which is 7 days each.

We have a pretty huge environment and i already see a warning for trap rows in the maintenance log and it is around 4800000, the same for syslogs too.

I would like to know if it would be okay for me to increase the period for around 2 weeks and if i would have any sorta issues because of this other than my maintenance running for a longer period.

Thanks,

Malcolm.

Find more posts tagged with

Accepted answers

mesverrum

If it has not been made clear enough yet, you do not want to increase the retention period for those in most cases. NPM isn't set up to efficiently handle a large volume of syslog/trap data and it is notorious for bogging down when people hit it with too many. As mentioned in the article posted by sja you can set up filters on the trap/syslog viewers to cut down on the impact they are having by only storing the ones that are actually useful for troubleshooting or alerting. In most cases when I sit down with clients and actually sift through the millions of traps they have it turns out that 90% or more of them are completely useless for the kind of stuff you would be doing in Orion. If you want to store events for forensics and such then it is much better to use a purpose built events tool like Kiwi/LEM/Splunk/whatever

-Marc Netterfield

Loop1 Systems: SolarWinds Training and Professional Services

LinkedIN: Loop1 Systems
Facebook: Loop1 Systems
Twitter: @Loop1Systems

All comments

sja

Yes you can...

:-)

I wouldn't...before doing that try that tip

Tips and Tricks for Managing Traps and Syslog in Orion NPM

Syslog and Trap Messages are Slowing Down my Monitoring Solution. What Would the Geek Do? - YouTube

If you already getting too much take tip no. 2

move everything to Kiwisyslog and forward those that are emergency

That will keep your DB healthy ...

bobmarley

I would go with SJA's advice and purchase a Kiwi license if you don't already have one.

Have Kiwi log the messages off to a file, database, whatever, and then make rules to only send the ones you want to alert on over to Orion.

Kiwi has a large capacity because all it does is logging, whereas Orion is doing lots of other stuff.

Otherwise you will eventually run into a situation where someone/somewhere turns on debugging on something and then suddenly

Orion get slow because the database grew to 10X what it was a few days ago.

jxchappell

be very careful with this...our retention period is 1 day...traps are garbage after they come out...don't use SW to store them...we use Splunk

mesverrum

-Marc Netterfield

Loop1 Systems: SolarWinds Training and Professional Services

LinkedIN: Loop1 Systems
Facebook: Loop1 Systems
Twitter: @Loop1Systems

malasherv

Thanks a lot everyone for your responses, i will go ahead and sit down with my clients and revisit all the traps and alerts that are in place and use filters to filter out the unwanted ones.

Thanks,

Malcolm.