Syslog top talkers report in NPM

10/15/2018 3:06 PM

4/8/2022 5:52 PM

This articles provides information regarding a Syslog top talkers report which lists the source IP address by count as well as severity of all syslog data needed.

This article does not apply if you are using Log Manager for Orion product.

Network Performance Monitor

An example or a  pre-made Syslog top talkers report can be found on this Thwack post

Syslog SQL Top Talker Queries (using SQL) 

Query to see 24 hours of data by the host, MessageType, and count (can modify SQL below for both Syslogs or Traps tables) execute the following queries:

-- Scripts are not supported under any SolarWinds support program or service. 
-- Scripts are provided AS IS without warranty of any kind. SolarWinds further 
-- disclaims all warranties including, without limitation, any implied warranties 
-- of merchantability or of fitness for a particular purpose. The risk arising 
-- out of the use or performance of the scripts and documentation stays with you. 
-- In no event shall SolarWinds or anyone else involved in the creation, 
-- production, or delivery of the scripts be liable for any damages whatsoever 
-- (including, without limitation, damages for loss of business profits, business 
-- interruption, loss of business information, or other pecuniary loss) arising 
-- out of the use of or inability to use the scripts or documentation.

select hostname, COUNT(Msgid) as total from Syslog
where DateTime>DATEADD(day, -1, GETDATE() )
group by hostname
order by total, hostname desc

or

-- Scripts are not supported under any SolarWinds support program or service. 
-- Scripts are provided AS IS without warranty of any kind. SolarWinds further 
-- disclaims all warranties including, without limitation, any implied warranties 
-- of merchantability or of fitness for a particular purpose. The risk arising 
-- out of the use or performance of the scripts and documentation stays with you. 
-- In no event shall SolarWinds or anyone else involved in the creation, 
-- production, or delivery of the scripts be liable for any damages whatsoever 
-- (including, without limitation, damages for loss of business profits, business 
-- interruption, loss of business information, or other pecuniary loss) arising 
-- out of the use of or inability to use the scripts or documentation.

select nodeid, hostname, SysLogFacility, SysLogSeverity, COUNT(Msgid) as total from Syslog
where DateTime>DATEADD(day, -1, GETDATE() )
group by nodeid, hostname, SysLogFacility,SysLogSeverity
order by total, hostname, SysLogFacility,SysLogSeverity desc

 

Advanced SQL reports: 

Some of the SQL codes shown in the Show SQL > SQL tab is basic and used in pulling data from the database tables, others are more complex and they stored SQL views.
 
As you cannot edit SQL directly the SQL tab, you can do the following if you wish to modify the SQL code:

1. 1. Click File > New Report > Advanced SQL report and click OK.
   2. Report Designer opens and in it, you can write your own SQL report.