RME 4.1 Syslog Report

Answered Question
Oct 6th, 2009

Hi,

What is the maximum number of records that can be displayed on the syslog report ?

Correct Answer by Joe Clarke about 7 years 4 months ago

I re-read your second post, and I think I misunderstood what you were doing. If you have a custom report template, and you've specified a specific mnemonic on which to search, the search is done by creating an SQL query which specifies the custom report parameters (i.e. the mnemonic in this case) along with the device ID(s) selected for the search. Since the syslog messages are divided up into multiple tables in the RME database (based on date), the SQL query is split into multiple queries with each running on a specific table. For each table queried, the results are added to the overall result set. Once that result set reaches the 10,000 message limit, no further queries are performed.

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (1 ratings)
Loading.
Joe Clarke Tue, 10/06/2009 - 19:22

There is a limit to displaying 10,000 messages. However, an unlimited number of messages can be exported.

chronix Tue, 10/06/2009 - 19:38

Hi jclarke,

Thanks for your quick response.

May I know where can I find the information about this ?

If I filter the messages that is displayed in the report ( e.g. only display certain Mnemonic ),

Which data does the 10,000 limit will be applied on, the filtered data or the original data ?

I'm facing an issue displaying a full month syslog report.

The report is meant to display certain Mnemonics only.

When I run the report generator for a whole month, I only get the last half month report, where the first half month is not displayed.

However if I run the daily report from the 1st day of the month, it can be displayed without any problem.

Any help would be appreciated.

Thanks

Joe Clarke Tue, 10/06/2009 - 19:51

There is a bug in your version of RME where the data displayed is unsorted. It commonly shows the oldest data first. The bug is CSCsz32320. I fixed it so that the latest messages are shown first up to the first 10,000. The sort is applied to the filtered data.

Correct Answer
Joe Clarke Tue, 10/06/2009 - 20:43

I re-read your second post, and I think I misunderstood what you were doing. If you have a custom report template, and you've specified a specific mnemonic on which to search, the search is done by creating an SQL query which specifies the custom report parameters (i.e. the mnemonic in this case) along with the device ID(s) selected for the search. Since the syslog messages are divided up into multiple tables in the RME database (based on date), the SQL query is split into multiple queries with each running on a specific table. For each table queried, the results are added to the overall result set. Once that result set reaches the 10,000 message limit, no further queries are performed.

chronix Tue, 10/06/2009 - 21:06

Since the limit 10,000 is based on the overall result set(CMIIW). I believe this is not the case. Since the last half month showed in the report has only <1,000 records.

Any clue to find the root cause of this issue ?

Thanks

Joe Clarke Tue, 10/06/2009 - 21:15

Are you hitting the max of 10,000 messages in the displayed output?

Joe Clarke Tue, 10/06/2009 - 21:44

Post a screenshot of the report you are running showing all of the parameters in addition to the SyslogAnalyzerUI.log.

chronix Tue, 10/06/2009 - 22:20

Found the issue already. The data has been purged. Thus there is no data from the first half month.

There was a miss communication with the person at the site.

The daily report that he was referring to is the report that has been generated daily.

Thanks for your clarification and the helpful explanation.

Actions

This Discussion