Orion Syslog - How to alert on lack of syslog data?

Question

We currently monitor hundreds of remote devices.  On occasion we will stop receiving syslog data from a device, but it will continue to respond to ping and SNMP polls.  We don't see this lack of logging until a problem occurs, and we find out we are missing logs.

A free tool like Kiwi Syslog can alert on lack of syslog data.  Is there any way that Orion's syslog server can report on *not* receiving data from a device for X amount of time?  (1 hr, 12hrs, etc...)

Thanks,

-Kevin

vhcato · Answer

You can create one stored procedure to encompass all devices, or only what's filtered via a WHERE statement. Then, you set it up as a scheduled SQL job that runs as often as you would like.

kclark · Answer

Vic,

Good idea.  I'm not a DBA, so I'm not sure if this would involve creating a custom SQL job for each device, or if you could execute the same script against all nodes.  (one is scalable, the other isn't)  I will bounce it off our in-house DBA.

Thanks for the guidance.

-Kevin

vhcato · Answer

Kevin, it seems like I'm using this paradigm a lot lately, but you could create a custom SQL job to count the number of syslog messages received from each device over a given period of time and have it populate a custom property with these values. You can then create an alert to monitor the values in this custom property and trigger when one falls below a certain threshold (or goes to 0). Hope this helps... ~ Vic