• State Not Answered
  • Locked Locked
  • Replies 1 reply
  • Subscribers 23 subscribers
  • Views 286 views
  • Users 0 members are here
Options
Related
This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.
You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

Is it possible to archive Linux syslog and audit.log files?

andrewjones

Hi All,

I am a beginner with SolarWinds LEM.  I have been reading the LEM User Guide (689 Pages).

We just installed the Linux LEM Agent on our test server.

Is it possible to have the LEM Agent compress and archive our logs (syslog and audit.log) to a file share somewhere?

We have a requirement to keep the system logs for 3 years.  I want to keep them in native format in addition to the events that LEM and filter up to the Database.

I haven't found this stuff in the user guide yet (but it could be there, it is almost 700 pages!).

Thank you,


Andrew 

  • 0

    It's possible to configure the LEM to create a new database for raw, un-normalized data as well as the normalized alert data used in Rules and Reports.  Details on how to do this are here:

    SolarWinds Knowledge Base :: Configuring Your LEM Appliance for Log Message Storage and nDepth Search

    Be aware that when you do this, the log partition on the LEM will be split 60/40, with the larger portion being dedicated to normalized data.  In the default LEM configuration, that means that the LEM will take the 234GB for log storage and create a new database for raw data using 93GB of that.  The same "90% full causes rotation" logic still applies, though, so if your current normalized database is larger than 90% of 60% (234GB * 0.6 * 0.9, or larger than 126GB) then the LEM is going to drop stored data until it gets under that threshold.  Keep this in mind, as turning on this option may cause a reduction in the retention span of the LEM.  You may want to resize the disk before proceeding to preserve your live data, such that your current database will fit in the "90 of 60" of the disk.

    SolarWinds Knowledge Base :: Resizing a LEM Virtual Appliance v5.4 or above

SolarWinds solutions are rooted in our deep connection to our user base in the THWACK® online community. More than 195,000 members are here to solve problems, share technology and best practices, and directly contribute to our product development process.

SolarWinds Customer Success Center Certification Media Vault Link Accounts
About THWACK Blogs For Government Edit Settings Free Tools & Trials
Legal Documents Terms of Use Privacy California Privacy Rights Security Information
©2024 SolarWinds Worldwide, LLC. All Rights Reserved.