Hi! I'm hoping someone can help with this.
We use LogLogic (and Lasso) to gather event logs from our Windows servers. In LogLogic, we've set up a set of alerts to forward syslogs to Orion based on certain conditions. It's working great (in general). Except...
Occasionally, syslog entries get duplicated in Orion. The alerts get triggered once and sent once from LogLogic. They show up twice in Orion as a syslog. I queried the syslog table in the NetPerfMon database and they are in there twice. This is happening randomly - not at the same time of day, not the same alert, not the same originating server. The only difference is the MsgID field in the syslog table - everything else is identical.
Any idea what could cause this? And secondary - regardless of the cause, is there some way I can tell Orion to not display the duplicates?