cancel
Showing results for 
Search instead for 
Did you mean: 
Create Post

Generic Syslog Connector

This connector is provided without warranty, support or guarantee of functionality.  Use of this file is at your own risk, and you accept all responsibility for the outcome of using this connector experiment.

If you choose to proceed (and read the READ.ME included), it'll make a connector that looks like this:

2015-06-19 14_06_43-SolarWinds Log & Event Manager.png

You'll need to make sure that your LEM is configured according to this KB for this connector to put the data anywhere.

Update: 06/24/2015 - Revision 2 to fix the "Doesn't start" problem

Update: 02/03/2017 - Fixed KB link to point to the right article in the new Success Center

Attachments
Comments

Thanks for providing this; however, I guess I don't understand why you would provide this and not support it?  This is clearly functionality the product needs and the community has requested and from the looks of it you have found a good stop-gap solution; why will you not support it?

I'm not a part of the connector team, dev team or product management team for LEM, so I can't promise any support.  If someone identifies an issue I can fix, I'll take a whack at it and then re-upload, but I don't want to set the expectation and then disappoint.  I've played with this in my lab, it seems to work, and I want to distinguish this from any future official solution produced by Solarwinds.

Okay, that makes sense and I appreciate the explanation.  Is there any chance we can get this ran up the support chain and approved so that it can be supported since it seems to fulfill a need and allows SolarWinds to check yet another box on the list of items that LEM can support.  Seems like a win/win to me.

I just don't want to start using it and then find support using it as a reason to not support me.  I have had that exact problem with other vendors.

I'm pretty sure that the Support team won't kick you to the curb for having a single off-label connector (and when I was in Support, I saw more than a few attempts to manipulate the connectors), but I understand the concern.  I know that the product team is aware of the need and requests.

Okay; sounds good.  Now away from the business side of things and on to the tech side:

My understanding of this is that you can setup this up on your appliance and point it to one of the syslog locations and it will pull everything into nDepth for archival and searching; however, no reporting or correlations.  Is that correct?

Correct.  Reports and Rules are built on normalized data, and this connector won't produce any.

This very well may address several of my needs so I am going to set it up in my lab as soon as I can.  Thanks for putting it together!

I just finished getting a LEM appliance setup in my lab with nDepth enabled on it and I have imported this connector.  When I try to start it on the appliance it won't start; any thoughts?

Revision 2: I apparently removed a line that I shouldn't have, and I put it back.  It's starting in my lab now.

Ok, I am able to start the connector now; however, I am seeing a few other issues.

So, here is what I have so far:

  • LEM appliance setup in lab and running properly
  • nDepth configured on the appliance
  • Orion sending all of the syslog data it receives to LEM so that I have syslog data to work with
  • GenericSyslog connector imported, running, and pointed at the log files where the Orion log data is going in LEM

With that being said; here are the two issues I am having:

Running a scan for new nodes is taking forever, not sure if this is due to this connector or not.

I am also not seeing any of the data in the LEM console, I have flipped the little switch on the upper right of the nDepth screen to look at logs and still nothing.

Thoughts?

I've had a couple people eyeball my XML code (totally unofficially) and they didn't find anything obviously wrong with it.  Rooting into my lab, I was able to confirm that the connector is moving through the log data it receives.

Now, I setup a known good connector (Cisco) and had it send nDepth data, and it looks like my nDepth data base is broken, so I need to work on that.  Do known good connectors send nDepth data successfully?

This is a lab and that was the only Syslog connector I was using.  What's odd is that I cam in today and there was a bunch of syslog data in there but nDepth searches didn't seem to be working very well (if at all) on it and when I stopped the connectors the data didn't seem to stop flowing in.  While I can't say what exactly is wrong here (either with my understanding or the connector) something certainly seems to be a bit off.

Yeah, I went and borrowed a lab that had never had the raw logging enabled, configured it, and it all seemed to work. There was a noticeable delay between sending data and it being searchable, but I have no idea what the cause there may be.

Ok, that is exactly what I was seeing so at least it's consistent.

Yeah, I don't think I can do anything about that.  If you test with another connector set to nDepth (I suggest the Vormetric connector), is there still a delay?

Well, I just setup the Vormetric connector to look at /var/log/local7.log  and send to nDepth on my appliance which is where a  lot of my log dump is going and after about 20 minutes I still show nothing when I do an nDepth search of the raw logs.  The problem is I don't know if this is because I am seeing the delay again or if it's because that connector simply isn't sending anything to nDepth.

Well, I come in today and I am seeing data from the Vormetric connector so it looks like that one is also very slow when it comes to being able to actually see the data in nDepth.  Any thoughts on what is causing the delay with both of these connectors? 

Nope, that might be worth having support look at the Vormetric connector to see if they can suggest a fix and then we can apply that to the Generic Connector.

Version history
Revision #:
1 of 1
Last update:
‎06-19-2015 03:10 PM
Updated by: