Where does Syslog write its log file to?

My organization wants to start monitoring syslogs generated from switches. To deal with this influx of data, we want to make sure our platform has the correct amount of space allocated for this change. Do Syslogs get written to your main orion platform or your orion swql database? In addition, if anyone has best practices for data rention of these logs that would be extermely helpful.

Find more posts tagged with

syslog

ncm

Accepted answers

All comments

ecmel

SolarWinds Platform keeps the syslog data in a dedicated SQL database which is different from the Orion core database, its default name is "SolarWindsOrionLog", but it can be renamed during installation process.

For further information, you can find details of the databases used by SolarWinds Platform in this link: https://support.solarwinds.com/SuccessCenter/s/article/Databases-used-by-SolarWinds-modules?language=en_US

SolarWinds Platform has a default "7 days" retention setting for syslog messages, but you can increase or decrease it based on your requirements and available disk capacity. If you want to increase the data retention period, it is better to do it slightly and check the impact on the size of your database and the performance of the platform.

bshopp

Another idea/option some of our customers use is to send all Syslog to our Kiwi Syslog product for long term audit and compliance retention and then forward on to Orion/HCO only the relevant logs needed for use in Orion/HCO - Kiwi Syslog Server | SolarWinds. In Kiwi you can write to a flat file or other sources as well.