Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials

Large Syslog Export

Hi guys,

We're going to be starting a new procedure on how we review logs. Part of this is to export the logs from our syslog server (Orion). My questions are the following:

How can I export a large amount of syslog data. The drop down in the syslog viewer limits me to 1000 records. I need to be able to pull "previous month" style exports, which are a lot more than 1000 records.
Is it possible to schedule this export?

Cheers!

Find more posts tagged with

Accepted answers

savell

The syslog table contains the origin IP address, and also the hostname (if it can be resolved via DNS).

So you could just add a where cause like this:

where ip = '192.168.1.1'

where hostname = 'myhost'

You can actually view the SQL from Report Writer (if you have a report that you like). This sometimes can be a good way to generate your SQL statements if you are not handy with SQL. Report Writer does handle dates a little differently however, so you need to watch for that.

Dave.

All comments

BillFitz

Hi RamirezH,

All of the syslog data is stored in the database. You can create a report on this data using the report writer. Once you have the desired report you can then export using any of the standard export options.

I am not sure about automating this export, perhaps someone else has a solution for that.

You will want to be a bit cautious in creating your report as you can very quickly end up with very large numbers of records in your report query.

Hope that helps.

ramirezh

Thanks Bill. I'll look into that. So avoid the standard viewer and do it via Report Writer...got it.

ramirezh

Ok, I'm using Report writer and it just hangs...it has a REALLY hard time pulling the report even on "past 7 days". Is there a way to tell how much data is being collected during a 24 hour period? I think I may have to try an alternate product

FormerMember

You can customize the report to pull the last 24 hours. Are you saving all of your syslogs? Or are you filtering?

FormerMember

Note that you might also want to consider Kiwi Syslog ($245.00) and Log Viewer. They save data to a file. The Orion database is meant for a subset of data and not for long-term storage. Databases have limitations with that kind of data.

www.solarwinds.com/.../