We use Orion NPM syslog as the primary collector, but many devices have not been configured to send syslog to Orion yet. Recently, I was talking with the Director of IT I report up through regarding syslog. He was thinking that were we to increase our syslog sources by a thousand or so nodes, that doing so would cause Orion to slow down ore than it already is. What do you think of that point of view? Would it be better to off-load collection duties to another syslog collector?
We have a licensed version of Kiwi Syslog, which we have been using on a limited basis (and separate from our Orion installation). I have heard that some people use Kiwi Syslog as their primary syslog collection software, instead of using Orion NPM syslog as primary. What are the advantages and drawbacks you have experienced in using this method? I have heard that you can't view Kiwi Syslog logs from the Orion GUI. But, I have also heard that Kiwi can forward interesting log entries from it to Orion. However, that brings up a question, of how do you define interesting log entries for forwarding? What may not normally be interesting to some could be interesting to others, depending on what event I am looking for.
Anyway, if you use Kiwi Syslog Server as your primary collector, could you please share your input here?