Error - Overloading syslog

[Mr_Resistor]

I checked my logs and noticed I started seeing this error every 2-3 minutes.

SyslogQueue count exceeded threshold! Clearing queue to prevent memory issues.


I only point my NAS (Synology), My Ubiqiti Controller, and my Sonicwall firewall at it.

My syslog retention is capped 2 months,
Logging severity at Informational
Log Size is 36GB in size.
Inserts is frozen at 17,115,778

CPU hovers between 22 and 27%
Logging is to an onboard SSD with 50% (246GB) Free
Memory shows about 46GB free (out of 65GB)

HSlogging is working as expected.

Any thoughts?

[Mr_Resistor]

Still happening. Anyone have any ideas?

[sparkman]

Are you sending all syslog info from those devices? For me, I've configured my network devices to only send certain syslog info to Ultralog. Just log entries that I want to trigger HS actions for.

[Pervez2602]

Think I might have the same issue here. Have a SYSLOG failure rate overnight in excess of 300,000. I do log a large amount of data and like Mr_Resistor I have my log capped at 2 Months although 2 weeks would work for me the way I use the plugin. I see there is a way to export the logs wondering if the actual logs could be saved to a different drive rather than that of HS.
Any help here appreciated as I do not have a clue how to get it up and working again.

[Mr_Resistor]

Pervez2602- Love the devices you created to show status. Can you share how you did them?

I'd also like the option to shorten the log capture time to less than 2 months. maybe something more like 2 weeks and the ability to store the log DBs on another drive. it would really help shrink the size of my backup and time requied..

The only way I've been able to get it running again is to stop the plug-in, delete the ultralog3_syslog.db3 file from the data\ultralog3 directory, and re-start the plugin.

I have to do it whenever the log file gets over 21GB or so.

[Pervez2602]

Hi Mr Resistor, Many thanks for the clue about deleting the database, not the answer I know but got me out of trouble so thanks.
Long time since i created the devices but here is a copy of the all important bits. The off hook icon I found on the web somewhere!

[Mr_Resistor]

Glad that got you back on the air. Whacking the DB is brute force solution, but it works in a pinch. Parsing the logs to change the status of the devices totally makes sense. I was wondering about the ones you posted in Post #4 on this thread, where you are showing the last 15 minutes of activity for debug, errors, info, warnings etc as gathered by the plugin.

[Pervez2602]

Hi there Mr Resistor, Pretty sure the plugin itself created those devices!
Coming back to the 2 months database setting, did you by any chance log a feature request with Ultra? Something I had thought about but never got around to doing. Perhaps now is a good time.

Peter

[Mr_Resistor]

The plug-in DID create them.... I just lost them in the sea of devices.

[Pervez2602]

Did you try reloading the plugin?

[Mr_Resistor]

They were there, just filtered out of the view.

[Guest]

Ultrajones , I can see you are not very active since two years here. are you still maintaining your plugins? I have asked some question too. Would it be possible give them a look, please . thanks

[Ultrajones]

Ultrajones , I can see you are not very active since two years here. are you still maintaining your plugins? I have asked some question too. Would it be possible give them a look, please . thanks

Please summarize the issue you are reporting.

[Pervez2602]

Glad to here you found them!
Peter

[Guest]

Please summarize the issue you are reporting.

Please see this topic Ultrajones

https://forums.homeseer.com/forum/ul...older-on-linux

+

Wanted to know if there's any progression porting ultramon3 to linux? I saw somewhere that your were near a release like 1-2 years ago? Thanks