Syslog Viewer searches are very slow and timing out

I am having trouble searching for things such as "deny tcp src outside", or specific IP addresses in the Syslog viewer when Informational or Debug is selected in the message severity. I am constantly receiving a timeout error. If I unselect those two, it will find what I need, but very slowly. There are many times I am needing to search informational messages, but since it is timing out, I cannot do so. I only retain 10 days of data, and the actual database is less than 5 GB. What can I do to speed this up and fix the timeout issue?

We are using Syslog Viewer 9.5.0 and a separate SQL 2008 server with Dual Xeon 2.5Ghz and 8 GB ram. The Orion server and SQL server are connected via gigabit. Nothing else in Orion seems slow. The SQL server has very little usage.

Thanks!

Jason

Find more posts tagged with

Accepted answers

All comments

bshopp

What SP are you on? You are using the syslog viewer, not the web UI?

pathgroup

I am using SP2. Yes, I'm using the viewer, not the web UI. I tried the WebUI, but it seemed even slower to me. I never gave it a chance to time out, so I don't know if it would have or not. Plus, I installed Kiwi to give it a try, didn't like it, uninstalled it, now the webUI no longer works.

bshopp

OK SP3 is the latest, might want to go to that. Why did you not like Kiwi? Which version did you try? v9? The Orion web UI no longer works? Have you re-run the configuration wizard?

pathgroup

I didn't realize that SP3 was out. I will definitely give that a try.

I tried version 9 of Kiwi. I think it was a little more in-depth/complicated than what I really needed. I am constantly building L2L VPN connections on our Cisco ASA, and I use the Syslog Viewer to quickly see what errors are showing on either phase 1 or phase 2 of the connection if there are any. I just type in their peer IP in the Message Pattern field, click on Search Database and it quickly shows me what I need. Kiwi may do this, but it just didn't look easy and quick to me.

I did re-run the configuration wizard, and that fixed my web UI.

Thanks!