1 Reply Latest reply on Jan 25, 2015 8:23 PM by HolyGuacamole

    SolarWinds databse question


      Hello all


      I have the follwing product installed and is being used to monitor few Cisco devices:

      Server & Application Monitor v6.1.0 Demo


      Today I saw some event messages saying:

           "Syslog reached 6400058 rows, which is above warning threshold of 1000000"


      I checked the min and max date for Syslog using:

      Select Min(datetime),Max(datetime) from Syslog

      and found that it's holding data of only last 3 days(70,00,000 rows)



      I have some specific questions:

      1. Is it common to have 70 lakh rows for 3 days ?

      2. If it's demo version, it's using MS SQL Server Express or full fledged Sql Server ?

      I am asking because Express edition has a limitation of 4GB and this message maybe because of it.

      3. I have come to know that the data is set to auto archive after every 6 months, still I can see data of only last 3 days. Why is it so ?

      4. How does the archival work, does it backup the data into a separate DB and then clean the original one ?

      5. Under these conditions, what's the recommendation. Should I just change the threshold value in the alert? and also where is it done ?



        • Re: SolarWinds databse question

          1. It depends on which devices are sending these logs. If it's firewalla sending logs, not a big surprise. The first thing you must to do is launch the syslog viewer on the SAM server and define some rules to limit the kind of logs that end up in the database


          2. SQL 2008 R2 Express with a 10 GB limit is what is packaged in the eval


          3. Which data are you refering to?


          4. I think you mean data retention. After the data hits the data retention setting, it will be purged out of the database


          5. See suggestion #1. For production, you can switch to a full version of SQL