LMS 3.2 Syslog Purge

[xshant]

Dear,

Can anyone explain what purge means in LMS 3.2 like for eg. syslog purge. Does it delete those files or makes a backup. If a backup where to find those syslog purged files?

Thanks,

Aamir

[Martin Ermel]

when LMS is configured correctly it is doing the basic work like discovery, config collection, inventory collection syslog analysis etc. as jobs running on a scheduled basis. The result of these jobs is stored in the database but as well, details of these jobs are kept as history for each kind of jobs. These results can be of interest for documentation purpose as well as for troubleshooting (i.e. when was inventory collection running successfully the last time for device A?). To maintain the history of these jobs, there are purge jobs which define how long the history of the jobs are kept.
For syslog, all messages arriving at the LMS server are collected in a flat file (windows: NMSROOT\log\syslog.log; solaris: /var/log/syslog_info). Then Syslog Analysis picks up those messages apply the defined syslog filters on those messages to decide which of these messages should be kept (put into the syslog database) and which to drop (do not put into the syslog database). The messages in the syslog database are available through the LMS web interface (e.g. RME > Reports > Report Generator > Sylog Report)
You have to say how long syslog messages should be available in this database (to prevent it from growing uninhibited). This is defined with a syslog purge job where you configure for how many days these messages will be available through the LMS GUI (as I said, nearly everything in LMS is done through jobs...).
If you decide to have a syslog backup (which is optional), the purged messages will be written into a file. These files are stored under NMSROOT\files\rme\syslog (windows, with NMSROOT being the installation path of LMS) and /var/adm/CSCOpx/files/rme/syslog (solaris)

[xshant]

So basically if i say syslog purge job 7 days, this means any syslog older than 7 days will be deleted from the database and i will not seem them in the syslog report unless i do syslog backup where the purge files will be written to another file. Is that correct?

Thanks,

Aamir

[Martin Ermel]

Yes, purged syslogs will not appear in any report and it is correct that if you say purge syslog entries older than 7 days, the purge job will remove all syslogs older than 7 days from the syslog database;
But you will not have access to these messages from the GUI anymore no matter if you do a syslog backup or not. The syslog backup is just for archiving purpose and you have to maintain these files yourself (I have seen several servers where these files consume a lot of diskspace over the years). In case you need any info from these files you have to use CLI tools.

Usually I configure syslog to delete messages older than 30 day (some customers even have 60) and then kick them off (no syslog backup configured).

But I maintain a backup of the raw syslog file for at least 1 year (which can be configured with the logrot.pl utility that comes with LMS).