Monitoring

The Server tab in Manager shows live collector statistics. For the collector’s own log, see Diagnostic Records.

The counters are kept by the collector service and cover only its current run. They start at zero whenever the collector starts, for example after it is restarted or the computer reboots.

Collector in the Diagram

The message flow diagram at the top of the Server tab shows the collector at a glance:

  • The Syslog Collector card lists the network interfaces: green for working ones, red for ones that could not start.

  • Messages between Originators and Syslog Collector: messages received on all interfaces.

  • Discarded: messages received but not stored, for all reasons. It turns red when the last discard was less than an hour ago, and orange when it was less than 24 hours ago.

  • Messages between Syslog Collector and Syslog Storage: messages written to syslog storage.

Click Syslog Collector in the diagram to show the sections below it.

Syslog Collector

Status Meaning

Collecting

The collector is running. Uptime shows how long it has been running. Buffer Usage shows how full the memory buffer is, for example 2% of 100,000.

Not Collecting

The collector service runs but cannot collect. Reason explains why: No network interfaces in the collector configuration.

Stopped

The collector service is stopped. Stopped At shows when. See Collector Service.

Buffer Usage turns red when it reaches Warn if buffer is % full. A short peak is normal during a burst. Usage that stays high means storage cannot keep up; see Performance.

Network Interfaces

The table has one row for each configured network interface.

Column Description

Protocol/IP/Port

Transport, local address, and port of the listener. 0.0.0.0 is shown as AnyIPv4(0.0.0.0), and ::0 as AnyIPv6(::0).

Connected Clients

TCP and TLS: clients connected now and the limit, for example 3 / 100. The limit is Maximum concurrent connections in the interface settings. UDP has no connections, so the column shows —.

Received

Total size of the syslog messages received on this interface.

Messages

Syslog messages received on this interface, before any are discarded.

Last Message

How long ago the last message arrived.

An interface that could not start is shown in red, with the error instead of counters — for example when another program already uses the port.

Discarded Messages

The table counts messages that the collector received but did not store, by reason. Last Discarded is red when the last discard was less than an hour ago, and orange when it was less than 24 hours ago.

Reason Cause

License limit

The license limit on originators or messages per hour was reached.

Filtered (content)

Dropped by keywords or the regular expression of the Incoming Filter. Expected when that filter is set.

Filtered (severity)

Dropped by Filter by severity of the Incoming Filter. Expected when that filter is set.

Unknown originator

New originator ID while If originator ID is unknown is Discard messages. See Originator IDs.

Inactive originator

The originator exists but Active is No. See Inactive Originators.

No originator ID

An originator ID rule could not extract an ID, and If unable to extract ID is Discard messages.

Storage failure

A new originator could not be registered in syslog storage.

Buffer overflow

The memory buffer was full.

For what to do about each reason, see Troubleshooting.

Stored Messages by Severity

Click Syslog Storage in the diagram to see the messages written to storage by severity, for the Current Clock Hour, the Previous Clock Hour, and Since Collector Startup.

A large share of Debug messages that nobody needs is a candidate for the Incoming Filter.

Related Topics