Is it possible to archive Linux syslog and audit.log files?

Question

Hi All,

I am a beginner with SolarWinds LEM.  I have been reading the LEM User Guide (689 Pages).

We just installed the Linux LEM Agent on our test server.

Is it possible to have the LEM Agent compress and archive our logs (syslog and audit.log) to a file share somewhere?

We have a requirement to keep the system logs for 3 years.  I want to keep them in native format in addition to the events that LEM and filter up to the Database.

I haven't found this stuff in the user guide yet (but it could be there, it is almost 700 pages!).

Thank you,

Andrew

curtisi · Answer

It's possible to configure the LEM to create a new database for raw, un-normalized data as well as the normalized alert data used in Rules and Reports.  Details on how to do this are here:

SolarWinds Knowledge Base :: Configuring Your LEM Appliance for Log Message Storage and nDepth Search

Be aware that when you do this, the log partition on the LEM will be split 60/40, with the larger portion being dedicated to normalized data.  In the default LEM configuration, that means that the LEM will take the 234GB for log storage and create a new database for raw data using 93GB of that.  The same "90% full causes rotation" logic still applies, though, so if your current normalized database is larger than 90% of 60% (234GB * 0.6 * 0.9, or larger than 126GB) then the LEM is going to drop stored data until it gets under that threshold.  Keep this in mind, as turning on this option may cause a reduction in the retention span of the LEM.  You may want to resize the disk before proceeding to preserve your live data, such that your current database will fit in the "90 of 60" of the disk.

SolarWinds Knowledge Base :: Resizing a LEM Virtual Appliance v5.4 or above