What will happend with trap/syslog viewer ?

Hi sja!

When you upgrade your current Syslog/Trap Viewers to LM, your existing log rules/alerts are not migrated to LM. However, the Syslog/Trap Viewers will remain on your Orion server in a read-only state, which allows you to view your log rule/alert conditions to assist with the manual creation of these rules in Log Manager.

On the licensing side, capacity based licensing is determined by a metric that will vary based on network, server and application activity. This often leads to overestimation of your log volume and paying for a higher license tier than required or in some cases underestimation, resulting in higher costs than originally anticipated. Node based pricing ensures that you can easily calculate the appropriate license size for your environment, and thus reduce the risk of under/over spending.

I understand that in your particular case, the cost per node may be considered high based on the log volume you are generating with Kiwi in place as an intermediary. However, for the vast majority of our users, node based pricing is favorable from a cost perspective. Worth noting that LM can handle a higher log volume than the current Syslog/Trap functionality in Orion. You could consider sending additional log data to LM than you currently send to Orion, to further assist with troubleshooting/root cause analysis and get more value from Log Manager.

Out of curiosity, how many log rules do you currently have in place within the Syslog/Trap Viewers? What kind of events do you typically forward from Kiwi to Orion?

Hi jhynds​

I use the real life adatole​ "large scale design"

Building a Large-scale SolarWinds Installation - YouTube

Syslog and Trap Messages are Slowing Down my Monitoring Solution. What Would the Geek Do? - YouTube

We use the kiwisyslog to take over "the noise" and forward the real "service affecting" stuff.

example:

300+ cisco 450x those type have around 300 interface each I don't think it will "very healthy" to forward each up/down/flap ...

200+ UPS that can generate alot of noise  when something is wrong..

Orion get from kiwi

Link problem from uplink interface

UPS kiwi will send ones every 30 min.

Other operation events

Orion is the "notification" tool  only..

So every trap that is  "service affecting" is generate SMS from Orion.

We don't have many traps  rules it's more  per vendor

UPS/APC Alert all

Core Uplink interface flaps

& 3-4 other vendors ..

:-)

I've been trying to find a clear answer. I understand that in a future version of NPM, the legacy syslog/trap viewers will be replaced with a cut down version of LM. The filters/rules in the legacy tools will be disabled but we will be able to open them up to see the rules.

Can you please clarify if we will need to purchase a LM license to set up alerting on syslog/traps?

If a customer has syslog/trap rules in place, will we be able to upgrade to a newer version and re-implement those rules in the cut-down version of LM without purchasing more licenses?

I have one customer with 75+ rules in the Trap Viewer that tags traps, send emails, etc. A dashboard has been set up in Orion specifically for these traps with queries and filters for specific tags. Would this customer need to buy LM to keep this functionality?

You will not need to purchase an LM license in order to configure alerting based on syslog/traps. As you mentioned, the rules from the legacy tools will need to be manually re-created within LM, but you will be able to alert on those rules in LM.

Of the 75+ rules that your customer has, they will be able to send emails and filter/search that data, however tagging and filtering based on tags will only be available in the full Log Manager license.

What kind of information is displayed on the traps dashboard that you have created?

Hi jhynds​

Are you saying that I could use LM as  trap/syslog notifications software ?

Just will need to import those alert manually ?..

So what is the full LM do ?that I will not get ?

/SJA

Yes, Orion Alert integration is included in both versions of Log Manager, so you can trigger alerts/notifications based on syslog/traps.

The full version currently includes features such as tagging/tag filtering, charting, live mode and 'Analyze Logs' from the Node Details page, not to mention other exciting features we are currently working on.

Cool that make many less nervous...

We just need to know how to use the new LM before  upgrate

Deprecation notices for the old trap and syslog viewer is not with NPM 12.3  release notes ...

Thanks jhynds​ - that alleviates a lot of my concern about dropping the trap/syslog viewers. It wasn't clear anywhere (that I could find) that the LM alerting functionality would be available without an LM license.

I'll touch base with you separately about the trap tagging.