Our syslog volume jumped from roughly 2.4 million events per day to 7.2 million over about a week, even though there were no configuration changes or new devices. The collector only shows the overall total, so I had to export seven days of data and group it by host manually. Two switches accounted for 56% of the traffic, largely because of one repeated warning, but finding that took most of a day. For environments with mixed vendors, is there a built-in per-source counter or dashboard you rely on, or do you rebuild this kind of query whenever log volume spikes? We also have hostnames, IPs, and a few relays in the path, which makes mapping senders back to physical devices more difficult. Our raw retention is only seven days, so analysis time matters.
3 Answers
A searchable log platform such as Elasticsearch, OpenSearch, Graylog, or a SIEM would make this much easier. Keep a dashboard that shows event counts by sender over the last 24 hours and seven days, with alerts for unusual growth. In your setup, I would also normalize the original hostname, source IP, relay, and vendor fields so the report maps cleanly back to the actual device.
Counting by sender was ultimately the solution, but the difficult part was resolving relays, hostnames, and IPs back to the real devices. With only seven days of raw retention, I am planning to add a persistent daily summary so the source breakdown is available even after the detailed events expire.
Most SIEM and log-management platforms can report volume by sender, message type, and time range. A useful starting query is to count events by the original sender or hostname, sort the results descending, and then drill into the top sources and repeated messages. That should make this a quick check instead of a manual export.
Be careful when several devices share a relay or source name. The hostname or device identity inside the event is often more useful than the collector-level source field, so make sure the query preserves and groups by that value.
The exact answer depends on the collector, since you did not mention which syslog software you are using. Many products have a built-in source-volume view, but the field names and whether relayed events retain the original sender vary quite a bit.
If you cannot quickly search and attribute the logs, it is worth revisiting the collection design. Even a basic saved query that counts messages by sender and sorts them by volume would have caught the two switches much sooner.