Archiving the Contents of the Syslog Table

Durandal16

Our compliance folks mandate a retention of 2 years for Syslog events and our Syslog table in Orion has grown beyond belief. It contains close to 200 million rows!

We are looking into serious log management solutions, and expect to get there within the year, but we need to do something in the meantime to reduce the size of that table.

In the meantime, I'm wondering what is the best option to archive the contents of the Syslog table before purging it. The main consideration is for saving the table in a format that would be reasonably easy to import into a log management tool.

Has anyone successfully done something like this?

byrona

I would strongly recommend you don't try and use the Orion syslog functionality for any form of log management; it's only designed for log alerting and if you try and do anything compliance related with it you are going to run into problems.

If you want something to satisfy compliance requirements that is fast and inexpensive to get up and running you should check out the SolarWinds Kiwi syslog server HERE; for a small product its relatively robust allowing you to both roll the logs, parse the logs into different files and zip/archive them as well.  At least give the free demo a try.