Syslog Reports

A syslog report analyzes messages that are already in syslog storage and writes the result to an HTML or text file. Use reports for counts, top lists, and trends over hours, days, or months. A report template defines what a report collects and how the file looks.

A report only reads syslog storage. The collector keeps writing new messages while a report runs.

How a Report Is Built

Stored messages pass the request range and filter into the For Each Message SQL commands, which fill an in-memory SQLite database; Initialization and Finalization SQL run once; Report file contents queries the database and becomes the output file
How a report is built (simplified schematic)

You start a report with a request: a template, a message time range, and an optional filter. Syslog Watcher then:

  1. Creates an empty in-memory SQLite database and runs the template’s Initialization SQL once.

  2. Reads each stored message in the range that passes the request filter and runs every For Each Message command whose Execute for expression matches.

  3. Runs the Finalization SQL once.

  4. Fills Report file contents with the results of its {{EXECUTE}} queries and writes the output file.

When the report finishes, the database is discarded and only the output file is kept.

Generate Now or Schedule

Generate Report Now Scheduled report

Generated by

Manager, on this computer

The Syslog Watcher Server service

While it runs

Manager is unavailable until the report is done

You can keep working in Manager

Output file

Saved where you choose

Saved in the server’s Output folder

Repeats

No

Optional: recurring, weekly, or monthly

Reports Button

In the Messages section of the main toolbar, click Reports Reports. The drop-down shows only the items that work in the current connection mode:

Item Local server Remote server No server (storage folder only)

Generate Report Now…​

✔

—

✔

Show Scheduled Reports

✔

✔

—

Report templates Manage Report Templates…​

✔

✔

✔

Related Topics