A rant about syslog on NPM

And PS:

The Administrator Guide shows a wrong entry for the severity variable at syslog variables:

${Severity} A network health score providing 1 point for an interface in a warning state, 1000 points for a down interface, and 1 million points for a down node.

The severity in syslog is actually between 0 and 7, 0 being the highest severity and 7 the lowest.

Thanks for the feedback, Questionario. The NPM PM will definitely see your suggestions, and I'll take care of the documentation fix.

Thanks,

I have had problems with the native Orion NPM Syslog functionality as well.  The built in Syslog component is by no stretch of the imagination an Enterprise syslog solution.

Here is a thought...  What if the Syslog component was removed from Native Orion NPM and re-developed (or re-develop Kiwi Syslog) as a module for Orion that functions semi-independently with it's own set of features and the ability to handle things on an enterprise scale.  To do this and handle the necessary volume (which is currently one of it's major problems) it may need to have the option for it's own database.  This would include a much more robust searching and reporting functionality for Syslog.

yes, I agree...

Maybe a module together with traps and some advanced logics to evaluate syslog messages (also forwarded windows event logs) and report on it...

but the current syslog still needs to be improved as noone would accept the current functionality to just disappear...

i am fine with logging the stuff to a file if orion cannot handle large syslogs (apparently a single firewall is too much already) but it cannot even do that in a proper way that you are able to view/use it afterwards...

Also I think there should be something like the paid kiwi syslog viewer included for free if you are using NPM... I mean we are only logging it to a file because Orion cannot handle the data and to have the functionality of the syslog viewer within orion I would have to pay for kiwi syslog viewer...

wow...

absolutely nothing seems to work with that NPM syslog...

If I add a rule to replace " with ' the whole rule gets messed up and sometimes the syslog crashes...

Hi Questionario--

I'll make sure to ping the PM on this for review and comment.

Thanks for your feedback.

M

Good feedback guys and we recognize we for sure have some room for improvement :)

One cool thing coming in the next version of Kiwi Syslog is pass thru authentication into the Kiwi Web Console.  So you can then add that as an external website with the pass-thru setup and users won't have to authenticate into Kiwi.  Also next version of Kiwi add multi-user web access so you can add some additional controls.

We have a few problems with that...

1.) a political one: We bought Orion to get rid of Kiwi ;-)

2.) we dont even have maintenance on Kiwi anymore.

3.) This is stuff that should work, period.

We were told that everything Kiwi CatTools and KiwiSyslog can do, can be done with NPM and NCM...

Now seeing that the NPM syslog is practically not usable...

The only way to use syslog on Orion right now is to keep the data only for a very short time (7days is recommended by Solarwinds) and not keep a history of it as logging to file has never ending bugs.

#1 - Kiwi is apart of SolarWinds, not sure if that help internally politically

#2 - if you want, you can sync with customer service to see if you can re-up

#3 - Don't disagree, we are cranking through stuff as fast as we humanly can to add new features, enhance existing features etc.  This is something we have on our list, I was just attempting to give you options.

Questionario

While I don't disagree with you on most of your points, I would like to respond to this one...

The only way to use syslog on Orion right now is to keep the data only for a very short time (7days is recommended by Solarwinds) and not keep a history of it as logging to file has never ending bugs

Monitoring systems in general aren't typically designed to manage logs for the sake of retention or archiving.  The purpose of Syslog on a monitoring system is simply to flag alerts and keep it just long enough for a person to investigate (which is typically in a day or so).  If you are interested in a Syslog system for the sake of retention and archiving (as is often necessary for compliance) then I would recommend you use a dedicated solution that is designed for that (Orion isn't).