Getting Data In

How to calculate volume of syslog traffic on syslog-ng server


I want to calculate the volume of Syslog data coming into Syslog-ng server.
For example, I am forwarding proxy logs to Syslog-ng server on port say 514.
I want to calculate the data coming in.
Can someone please help me with this?


You could check the directory size on the syslog-ng server, your /etc/syslog-ng/syslog-ng.conf will tell you where you are storing the incoming syslog data. du -h <directory> will provide you the size of directory in typical linux environment.

0 Karma

Ultra Champion

What exactly do you want to do? Have you already ingested this data into Splunk and want to now calculate the volume of it? Or do you need to calculate (estimate?) the volume of data coming in in preparation for onboarding this data into Splunk?

In the first case, the best place to look would be the splunk internal logs on license usage for this particular source / sourcetype / host / index (depending what is easiest to distinguish data coming from this particular syslog server). For example to get the license usage for sourcetype syslog over past 14 days:

index="_internal" source="*license_usage.log" type=Usage earliest=-14d@d latest=@d st=syslog | timechart span=1d sum(eval(b/1024/1024)) AS DailyMB

If the data is not in Splunk yet, you would have to look at the size of the files syslog-ng has written and divide that by the time span those files cover.

Get Updates on the Splunk Community!

BSides Splunk 2022 - The Call for Papers is now Open!

TLDR; Main Site: CFP Site: CFP Opens: December 15th, ...

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...