Firewall collects huge number of syslogs into a giant file then sends it causing delays.

[avisonenthal]

We are having a huge problem with only one of our syslog destinations. Instead of sending the syslogs as they are generated, the firewall is collecting them into a huge file (10-40GB) and sending this a few times a day. This is ridiculous and is making the syslogs useless. It is only doing this for one of 4 syslog servers. Percent utilization of the firewall is at 2%. Anyone else seen this? I cannot get technical support to respond to me.

[kiwi]

Hi @avisonenthal ,

What does 'debug log-receiver statistics' tell you ?

Are the logs being queued ? Are you seeing drops ? (check syslog enqueue count for unusually high value or drops)

Have you tried restarting the process (debug software restart process log-receiver) ?

Cheers,

-Kiwi.