Security Compliance

Unable to compress large syslog data files

The log size is large and Linux has trouble compressing it. Use the setlogrotate command to manage log size and adjust the syslog log rotation.

First published date

10/18/2018 8:04 PM

Last published date

8/26/2025 4:06 PM

Overview

This article applies to Security Event Manager (formerly Log & Event Manager).
The log size is over 7 GB and Linux has trouble compressing it.

Product section

Security Event Manager

Cause

ASA, for example, can generate up to 6 GB of syslog an hour if info severity is enabled.
In 24 hours, that log can easily exceed 8 GB.
The Log file is exceeding 8 GB, and SEM is set to compress the log files daily.
Linux cannot compress files over 8 GB.

Resolution

Change the default values in SEM by going to the CMC shell in vSphere or PuTTY.
In the command prompt, enter the command appliance.
Enter the command setlogrotate, and then change to hourly. This allows SEM to compress a file each hour instead of daily.
Note: If your Logs/Data partition is full, or a particular syslog file is large, contact SolarWinds Support to assist in this process.

Disclaimer: Please note, any content posted herein is provided as a suggestion or recommendation to you for your internal use. This is not part of the SolarWinds software or documentation that you purchased from SolarWinds, and the information set forth herein may come from third parties. Your organization should internally review and assess to what extent, if any, such custom scripts or recommendations will be incorporated into your environment. You elect to use third-party content at your own risk, and you will be solely responsible for the incorporation of the same if any.