Celebrate National IT Professionals Day with 3 months of free Premium Membership. Use Code ITDAY17

x
?
Solved

Rsyslog & loganalyzer DB size

Posted on 2014-10-14
12
Medium Priority
?
399 Views
Last Modified: 2014-10-17
This is eating up the disk space at 4 gigs per day. The system runs very slow due to being old hardware so I would like to trim this down. The server is receiving syslog information from one firewall and I have 27 firewalls that I want to setup for this so just imagine how much disk space this would eat up.  Is there a setting somewhere that I can change to not log so much, or truncate the database every 8-10 hours?
0
Comment
Question by:stlhost
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 6
  • 4
  • 2
12 Comments
 
LVL 13

Expert Comment

by:Sandy
ID: 40379877
why don't you put compress parameter in logrotate.d/<log_conf> file ?

or you can use gzip on the files as-well.

TY/SA
0
 
LVL 2

Author Comment

by:stlhost
ID: 40380577
The data goes into an SQL database.
0
 
LVL 13

Expert Comment

by:Sandy
ID: 40380724
OK.. Which firewall it is and what is the log debug level ?

Please share log configuration of firewall

TY/SA
0
Application Discovery Service in AWS

In the era of the cloud, customers migrating away from their existing on-premise infrastructure. This requires lots of planning, strategies, and effort to identify their existing resources and determine how best to migrate.  Datacenter migrations happen in four phases -

 
LVL 2

Author Comment

by:stlhost
ID: 40380842
Sonicwall 3500. Syslog is set to local 0, syslog format is Webtrends.
0
 
LVL 62

Expert Comment

by:gheist
ID: 40380993
4G/day is not much...
0
 
LVL 2

Author Comment

by:stlhost
ID: 40382004
Not really I guess when you are sending all info over I suppose but was wondering if there was a way to lighten the load or trim the database on daily basis.
0
 
LVL 62

Expert Comment

by:gheist
ID: 40382542
Would be nice to know what type pf "SQL database" data is using, so I can suggest optimal either trigger or schedule script.
Do you record now() when log records arrive?
0
 
LVL 2

Author Comment

by:stlhost
ID: 40384276
That I have no idea. I just used what came with the program and created a database based on http://nolabnoparty.com/en/install-rsyslog-loganalyzer/

CREATE DATABASE Syslog;
USE Syslog;
CREATE TABLE SystemEvents
(
        ID int unsigned not null auto_increment primary key,
        CustomerID bigint,
        ReceivedAt datetime NULL,
        DeviceReportedTime datetime NULL,
        Facility smallint NULL,
        Priority smallint NULL,
        FromHost varchar(60) NULL,
        Message text,
        NTSeverity int NULL,
        Importance int NULL,
        EventSource varchar(60),
        EventUser varchar(60) NULL,
        EventCategory int NULL,
        EventID int NULL,
        EventBinaryData text NULL,
        MaxAvailable int NULL,
        CurrUsage int NULL,
        MinUsage int NULL,
        MaxUsage int NULL,
        InfoUnitID int NULL ,
        SysLogTag varchar(60),
        EventLogType varchar(60),
        GenericFileName VarChar(60),
        SystemID int NULL
);

CREATE TABLE SystemEventsProperties
(
        ID int unsigned not null auto_increment primary key,
        SystemEventID int NULL ,
        ParamName varchar(255) NULL ,
        ParamValue text NULL
);

Open in new window


Thanks
0
 
LVL 62

Accepted Solution

by:
gheist earned 2000 total points
ID: 40385338
It is mysql :)
select count(*) from syslog where ReceivedAt > (curdate() - 3 months)

if it seems what you want to delete just replace select count with delete
0
 
LVL 2

Author Comment

by:stlhost
ID: 40385519
mysql> select count(*) from SystemEvents where ReceivedAt > (curdate() - 90);
+----------+
| count(*) |
+----------+
| 43151859 |
+----------+
1 row in set (2 min 9.10 sec)
0
 
LVL 62

Expert Comment

by:gheist
ID: 40386025
I was meaning to delete where ReceivedAt is OLDER than those 3 months...
0
 
LVL 2

Author Comment

by:stlhost
ID: 40386557
oh lol. Thanks
0

Featured Post

Supports up to 4K resolution!

The VS192 2-Port 4K DisplayPort Splitter is perfect for anyone who needs to send one source of DisplayPort high definition video to two or four DisplayPort displays. The VS192 can split and also expand DisplayPort audio/video signal on two or four DisplayPort monitors.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Phishing is at the top of most security top 10 efforts you should be pursuing in 2016 and beyond. If you don't have phishing incorporated into your Security Awareness Program yet, now is the time. Phishers, and the scams they use, are only going to …
Google Drive is extremely cheap offsite storage, and it's even possible to get extra storage for free for two years.  You can use the free account 15GB, and if you have an Android device..when you install Google Drive for the first time it will give…
Learn how to get help with Linux/Unix bash shell commands. Use help to read help documents for built in bash shell commands.: Use man to interface with the online reference manuals for shell commands.: Use man to search man pages for unknown command…
Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.

730 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question