Security Compliance

The syslog file is empty, logs show 0 kb, but data is sent to SEM

The particular log in Security Event Manager (formerly Log & Event Manager) has not rotated. This means you are seeing, for example, a user.log with 0 bytes. Also, the user.log.1 has not compressed and contains incoming data. Subsequently, the connectors are pointing at user.log and see no current data.

First published date

10/17/2018 5:23 PM

Last published date

8/17/2021 4:19 AM

Overview

The particular log in SEM has not rotated. This means you are seeing, for example, a user.log with 0 bytes. Also, the user.log.1 has not compressed and contains incoming data. Subsequently, the connectors are pointing at user.log and see no current data.

Product section

Security Event Manager

Cause

High frequency logging to non local0-7 log files may break their rotation. This means the default log shows 0 kb after the rotation occurs.

Resolution

Edit the syslog service on the device to log to any syslog local[0-7].log facility, as they deal with high frequency logging.
Contact SolarWinds Support if this does not resolve the issue.

Disclaimer: Please note, any content posted herein is provided as a suggestion or recommendation to you for your internal use. This is not part of the SolarWinds software or documentation that you purchased from SolarWinds, and the information set forth herein may come from third parties. Your organization should internally review and assess to what extent, if any, such custom scripts or recommendations will be incorporated into your environment. You elect to use third-party content at your own risk, and you will be solely responsible for the incorporation of the same if any.