1 Reply Latest reply on Aug 4, 2009 2:22 PM by justty

    Syslog truncating information

    justty

      My FTP Log Shows:

      Timestamp: 08/03/2009 06:14:39

      Service: FTP

      Listener (IP:Port): My Server IP

      Host: My FTP FQDN

      Session ID: Generated from FTP App

      Client (IP:Port): IP client is coming from

      User: FTP User ID

      Command: timeout

      Parameters: FTP Folder information

      Type: Information

      Error: 0

      Severity: Informational

      Description: Timeout session: 603.34375 secs inactivity, Login state

       

      All this information is loaded into ORION Syslog and we are seeing that the information is being truncated when added to the Message Type Column.

      The following information above is being entered into the message type Column:

      Host=MY FQDN, SessionID=FTP Application generated, Listener=My FTP IP, Client=Client IP, User=UserName

      What we are seeing is that the FTP username is being truncated, since it is the last entry.

      My SQL guys wants to verify that we can change the value for the column "Message Type" on the Table "Syslog" within the "NetPerfMon" Database from  varchar100 to varchar150. That way we capture all the information from our FTP server.

      Is there a place in ORION that we make the change, or do we do it directly to the DB. Also, if there is a DB upgrade, will it be reset back to varchar100?

        • Re: Syslog truncating information
          justty

          I had to expidiate this issue. Here was tech support answer:

           

          "You can change the column varchar(xxx) number, but it will be unsupported. Also during a DB upgrade it may change the value back or fail, since it is not at varchar(100). The best solution is to submit a feature request"

           

          Here is what I did:

          I set it to varchar(250) and created a document in my ORION UPGRADE folder on the server with a FYI to set it back to varchar(100) before any update and to change back to varchar(250) after updates. Not a big deal because we are sweeping this table to a historical reporting DB (compliance related).

          I also opened a feature request to add a field in the syslog setting to allow this column to be defined by the customer.