Submit a ticketCall us

WebinarUpcoming Webinar: Know What’s Changed – with NEW Server Configuration Monitor

Change management in IT is critical. But, even with a good change management process, changes are too often not correctly tracked, if at all. The configuration of your servers and applications is a key factor in their performance, availability, and security. Many incidents can be tracked back to an authorized (and sometimes unauthorized) configuration change, whether to a system file, configuration file, or Windows® Registry entry. Join SolarWinds VP of product management Brandon Shopp to discover how the new SolarWinds® Server Configuration Monitor is designed to help you.

Register now.

Home > Success Center > Network Performance Monitor (NPM) > Syslog service is crashing due to insufficient memory

Syslog service is crashing due to insufficient memory

Created by Daniel Polaske, last modified by MindTouch on Jun 23, 2016

Views: 2,732 Votes: 0 Revisions: 4

Overview

The Syslog service is periodically crashing.

The following errors are reported in the SyslogService.log (C:\Program Files (x86)\SolarWinds\Orion\SyslogService.log):

Line 140: 2015-11-19 01:10:43,026 [498] ERROR SolarWinds.Orion.Common.SWEventLogging - Service was unable to open new database connection when requested.
    Line 143: 2015-11-19 01:22:28,115 [UDPListenerThread] ERROR SolarWinds.Orion.Common.SWEventLogging - Server Exception Error: System.OutOfMemoryException: Exception of type 'System.OutOfMemoryException' was thrown.
    Line 152: 2015-11-19 01:59:14,548 [UDPListenerThreadIpv6] ERROR SyslogService.SyslogService - A blocking operation was interrupted by a call to WSACancelBlockingCall
    Line 153: 2015-11-19 01:59:15,203 [506] ERROR SolarWinds.Orion.Common.ManagedNodeState - ManagedNodeState.NodeRefresher(): Error refreshing managed node status from Nodes table!
    Line 160: 2015-11-19 01:59:15,203 [397] ERROR SolarWinds.Orion.Common.ManagedNodeState - ManagedNodeState.NodeRefresher(): Error refreshing managed node status from Nodes table!
    Line 167: 2015-11-19 01:59:15,218 [98] ERROR SolarWinds.Orion.Common.SWEventLogging - Syslog Service Unhandled Exception Cannot access a disposed object.

Environment

All NPM versions

Cause 

The system is running low on memory and it is causing Syslog service to crash due to the large amount of incoming data.

Resolution

Do the following steps to increase the time outs for the database connection and command:

  1. Go to C:\Program Files\Solarwinds\Orion.
  2. Open the SWNetPerfMon.db file.
  3. Scroll down to the bottom and change the following
    Connection timeout in seconds - Timeout=20 to 200
    Database Command timeout in seconds - CommandTimeout=90 to 900
  4. Save the file then stop and restart all services.

 

Alternatively, you can also run the following SQL command to find the Syslog top talkers and attempt to limit the Syslog export at the device end to prevent the flood of syslog from crashing the service:

SELECT TOP 100000 Hostname, COUNT(*) FROM Syslog
WHERE DateTime>DATEADD(DAY, -1, GETDATE())
GROUP BY Hostname

 

If the above options fails, it is recommended to increase the memory size of the host in question.

 

Last modified

Tags

Classifications

Public