nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

Help with Syslog and Orion please

freemen

I have been told that we need to start using Syslog with our Orion installation. I am pretty good with Orion, but I have never configured or used syslog before. After doing a little reading, I think I know:

1. Since I already installed the Orion syslog service, the syslog viewer will start receiving messages without any further input, is that correct?

2. I may want to configure one or more filters to restrict the incoming messages to certain types.

3. I must configure syslog to export to my Orion polling engine IP address on any and all network devices on which I want to collect data. Right?

4. I will have to keep an eye on the Orion database in general, and in particular, the syslog related tables as I add syslog sources to make sure my DB does not get too large. Any hints on how to monitor that?

5. Can the Orion poller be set up to write syslog data to another syslog server, or must it write to the Orion database?

Any help will be greatly appreciated as I am a little nervous about getting this up and running smoothly. Thanks.

Find more posts tagged with

Accepted answers

All comments

spdd3mn

Good Luck!!!

I never got much help even after opening many many tickets.

I basically had to keep filtering my syslog until I got rid of all the useless messages I did not want.

1. Yes

2. You have too or like me I got 3000 emails when I first turned it on...I had to keep turning it off an on to filter messages

3. Yes all devices you want to set solarwinds IP as syslog server, also make sure your logging level is not debug!!! set the severity you want to look for first. Some items like cisco power supply failing is not considered an Emergency by Cisco, it is only informational which is nuts in my book. So you will have to play with the filter a ton. I have been working on mine on and off for 13months to get this to where it is at least usable.

4. Recomend talking to your Unix guys and getting San space for solarwinds

5. Don't know about another server I just use Orion DB on SAN

FormerMember

1. Since I already installed the Orion syslog service, the syslog viewer will start receiving messages without any further input, is that correct?

Yes. Just configure your sources to send to the Orion IP

2. I may want to configure one or more filters to restrict the incoming messages to certain types.

Syslog is a chatty protocol. Lots of informational messages are sent that aren't interesting. You need to figure out what you care about and throw away the rest, or you're going to have issues, but that's the nature of Syslog

3. I must configure syslog to export to my Orion polling engine IP address on any and all network devices on which I want to collect data. Right?

yes

4. I will have to keep an eye on the Orion database in general, and in particular, the syslog related tables as I add syslog sources to make sure my DB does not get too large. Any hints on how to monitor that?

If you do your filtering from #2, you shouldn't have problems. You also want to go into the Syslog viewer and look at how many days of Syslog you want to keep. By default, it's set to 7. Some users run into problems because they'll try to save months of data with very little filtering, but if you filter and groom, you'll be fine. To monitor database size, you can use APM or you can just look at the disk size of the DB server using NPM.

Can the Orion poller be set up to write syslog data to another syslog server, or must it write to the Orion database?

It has to write to the Orion DB, but again, if you filter the data to what you care about and groom old data, you won't overload the database. It's hard to see the management value of keeping unfiltered syslog messages for months.

freemen

Thanks, Denny for the reply. Just the kind of answers I needed.

freemen

Denny,

Is there any way to predict the size of the data influx to the Orion database and the workload on the Orion poller that would result from enabling unfiltered syslog from essentially all of 6000 elements in an Orion monitored network?

My guess is that there are just too many variables to be able to even guess at the answer, but I had someone ask me that earlier today. Would I be safe in saying that such an action is just not predictable or advisable?

Shouldn't one always start with deciding the event types that one wants to filter for and a list of the devices that one wants to collect from?

pserwe

I also have huge issues with syslog handling by Orion. I want the entire syslog alerting/interface to stop being handled by a seperate application, I want to be able to manage these alerts from the Orion Network Performance Monitor application.

Additionally, the only good way I have found to filter traps was to create a rule to drop them based on certain criteria. I want the trap alerts not handled by an external application as well, it honestly makes it difficult to keep track of alerts configured in 4 different places.

FormerMember

Is there any way to predict the size of the data influx to the Orion database and the workload on the Orion poller that would result from enabling unfiltered syslog from essentially all of 6000 elements in an Orion monitored network?

That's too specific to your environment. Unfiltered syslog from that many boxes doesn't sound advisable. Filter.

CaptainOrion

You may want to look at this:

freemen

Am I also correct in thinking that the easy part is to get the Orion server setup for processing syslog messages? Install the syslog service and configure filters, right?

The hard part will be configuring syslog forwarding on each device type and vendor? I would imagine that the process will vary widely. Am I right?