I am unable to verify the cause of this
I am unable to verify the cause of this
My first thought is you could be taking in more messages than it is designed for. Here is some info on scaling.
Another may be the order the rules are processed. Sometimes throwing out the 'trash' messages at the top of the list helped since the message didn't have to fall through all the rules before being discarded.
If it ends up being message volume and the rules don't fix it you could possibly front end your Orion with a Kiwi server and use that server to filter out the junk messages before they get to Orion. Kiwi also has limitations that you can check out here
How many messages can Kiwi Syslog manage? - Geek Speak - Resources - THWACK - SolarWinds Community
My first thought is you could be taking in more messages than it is designed for. Here is some info on scaling.
Another may be the order the rules are processed. Sometimes throwing out the 'trash' messages at the top of the list helped since the message didn't have to fall through all the rules before being discarded.
If it ends up being message volume and the rules don't fix it you could possibly front end your Orion with a Kiwi server and use that server to filter out the junk messages before they get to Orion. Kiwi also has limitations that you can check out here
How many messages can Kiwi Syslog manage? - Geek Speak - Resources - THWACK - SolarWinds Community
SolarWinds solutions are rooted in our deep connection to our user base in the THWACK© online community. More than 190,000 members are here to solve problems, share technology and best practices, and directly contribute to our product development process.