Monitoring

Received

Total number of syslog messages received from the network since the server started. This includes messages that were later dropped by the incoming filter or buffer overflow.

Processed

Number of messages successfully written to storage. Under normal operation, this should track closely with Received minus filtered messages.

Filtered

Number of messages discarded by the Incoming Filter. A steady non-zero value here is expected when an incoming filter is on.

Dropped

Number of messages discarded due to memory buffer overflow. This should normally be zero. A non-zero value means the buffer is too small, storage is too slow, or both.

Buffered

Current number of messages queued in the memory buffer waiting to be written. A value that is consistently non-zero but not growing means the buffer is absorbing bursts. A value that grows continuously indicates the storage writer cannot keep up.

Dropped > 0

Buffer overflow — increase buffer size or reduce incoming message rate with the Incoming Filter

Buffered growing continuously

Storage write throughput too low — check storage disk speed; see Performance

Received = 0 on an interface

No messages arriving — check network connectivity and originator configuration

Processed much lower than Received

High filter rate — review Incoming Filter settings if unexpected

All counters = 0

Collector not running — see Windows Service