Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials

Are there Advanced SysLog Summary replacements/alternatives for 2023.3.0?

Hey everyone.

Last week I finally upgraded from one of the 2020 versions of the Orion/NPM/NCM package to 2023.3.0
I was quickly dismayed to notice the Advanced SysLog Summary widget had vanished from my summary home....

and then gobs of issues with LogViewer in general (as opposed to the legacy interface, closer to what Event Viewer is now).

Can anyone recommend a script or a widget or anything that is similar to what Advanced Log Viewer was? As it stands now, I have no means of seeing a good summary of SysLogs on my main Summary View, which is IMMENSELY lowering visibility, and making my life far harder than it should be.

Thanks.

Find more posts tagged with

Accepted answers

All comments

ahawkins72

Hey J, I am sorry I did not see this sooner, but we have noticed this as well and from my organization it has been submitted as a feature request. I am also currently working on trying to at least somewhat mimic the functionality so I'll let you know (if successful)

KMSigma.SWI

What would you like to see and how would you want it represented? (I don't have access to any pre-2023 machines to look at the widget).

I'm sure we can come up with a SWQL query that'll give you what you want.

@ahawkins72 - feel free to chime in as well.

ahawkins72

Hey Kevin, hopefully this uploads okay. I'm trying to attach a screenshot of the widget I took before we upgraded from 2020.2.6. One of our customers deeply misses this widget.

JFollis

Thanks for grabbing that shot A.I don't have easy access to 2020.x anymore.
Yes Kevin, this is what I am looking for. A widget with summary/count of Syslogs by MessageType & Severity over an adjustable time period

KMSigma.SWI

In my home lab, I don't have any Cisco gear, so I'm sort of out of luck.

Any chance either of you can provide me with the results of a SWQL Query so I can help flesh this out?

SELECT TOP 10 [FieldValue].LogEntryFieldID
     , [FieldValue].LogEntryFieldValueID
     , [FieldValue].LogEntryID
     , [FieldValue].Name
     , [FieldValue].TextValue
     , [FieldValue].NumericValue
     , [FieldValue].DateTimeValue
FROM Orion.OLM.LogEntryFieldValue AS [FieldValue]
INNER JOIN Orion.Nodes AS [N]
     ON [FieldValue].Event.NodeID = [N].NodeID
          AND [N].Vendor = 'Cisco'

I've got it 80% there, but I need to know how to pull out the Message Type.

Please feel free to anonymize anything you feel is sensitive.

KMSigma.SWI

What does the "Who" link to? I'm not 100% sure we can get that data.

KMSigma.SWI

Circling back here. I was able to develop a query that would pull the information needed to build the widget.

For everyone's knowledge, I'm putting that query here:

SELECT SUBSTRING([Log].Message, 2, CHARINDEX(':', [Log].Message) - 2) AS [MessageType]
     , [Log].[Level]
     , COUNT([Log].LogEntryID) AS [Quantity]
FROM Orion.OLM.LogEntry AS [Log]
WHERE [Log].LogEntryTypeID = 2 -- syslogs
     AND [Log].MessageDateTime >= ADDDAY(- 1, GETUTCDATE())
     AND [Log].Message LIKE '[%]%: %' --matching for Cisco Logs
GROUP BY [Log].[Level]
     , SUBSTRING([Log].Message, 2, CHARINDEX(':', [Log].Message) - 2)
ORDER BY CASE [Log].[Level]
          WHEN 'Emergency'
               THEN 0
          WHEN 'Alert'
               THEN 1
          WHEN 'Critical'
               THEN 2
          WHEN 'Error'
               THEN 3
          WHEN 'Warning'
               THEN 4
          WHEN 'Notice'
               THEN 5
          WHEN 'Informational'
               THEN 6
          WHEN 'Debug'
               THEN 7
          ELSE 99 -- Not a standard syslog level
          END
     , COUNT([Log].LogEntryID) DESC

However, there is a big caveat. Because of the way that the platform stores logs, this query will nearly 100% of the time will timeout. This is a symptom of the way logs are stored in the database so they are accessible considering the volume the platform supports.

mharvey

I updated this just a little as the message type was giving me a bit of a fit. I added node information to this to help group and limit:

SELECT [Node].Caption,
SUBSTRING([Log].Message, 2, CHARINDEX(':', [Log].Message) - 2) AS [MessageType]
, [Log].[Level]
, COUNT([Log].LogEntryID) AS [Quantity]
FROM Orion.OLM.LogEntry AS [Log]
Join Orion.Nodes as [Node] on [Log].NodeID = [Node].NodeID
WHERE [Log].LogEntryTypeID = 2 -- syslogs
AND [Log].MessageDateTime >= ADDDAY(- 1, GETUTCDATE())
AND [Log].Message LIKE '%: %' --matching for Cisco Logs
AND [Node].Vendor like 'Cisco%'
GROUP BY [Log].[Level], [Node].Caption
, SUBSTRING([Log].Message, 2, CHARINDEX(':', [Log].Message) - 2)
ORDER BY CASE [Log].[Level]
WHEN 'Emergency'
THEN 0
WHEN 'Alert'
THEN 1
WHEN 'Critical'
THEN 2
WHEN 'Error'
THEN 3
WHEN 'Warning'
THEN 4
WHEN 'Notice'
THEN 5
WHEN 'Informational'
THEN 6
WHEN 'Debug'
THEN 7
ELSE 99 -- Not a standard syslog level
END
, COUNT([Log].LogEntryID) DESC