Event Console - Saved as sqlite files nowadays?

General
,
1

Hello!

I was looking into using checkmk for displaying and archiving eventlogs from our network switches, as we are now called to do by our overlords.

According to the Wiki ( The Event Console - Processing logs and SNMP traps - at 10.2) it says the files are saved as *.log files in the directory. There aren’t any, only sqlite-files now.

I assume this is just not changed in the documentation, right?

Is there an (easy) way to get out all logs from a host later on and forward it, if they are asked for? Or should I use a more dedicated syslog-archiver? We don’t actually need much really, so I had hoped I could use checkmk as a “collect logs and put them as text-files there and be done” thing :smiley:

Thanks for any input.

Lg Lukas.

1 Like
2

Hi Luks

It depends on whether you only need the events forwarded to the Event Console or all events generated by the devices.

Events are initially stored in memory and, once they expire or are archived, they are written to the SQLite database. In general, you can export all events via the GUI, through an automation user as CSV or JSON, or via the Event Console REST API. If required, you can also access them directly from the SQLite database.

However, if your requirement is long-term archiving of all raw syslog messages, a dedicated solution such as syslog-ng, Elastic, or Splunk is usually the better choice. The Event Console is primarily designed for event processing and monitoring workflows rather than serving as a full log archive.

2 Likes