Slowness in Syslog

[chiprocks]

I just loaded up Cacti 8.7e with the compatible Syslog 8.7e. It seems to have been installed and working fine. It is running on a VM that has approx 2ghz of processor, 1024 of memory, and 10GB of disk. It is running Ubuntu 9.04 Server. I am running the normal poller.php and not spine...

When I log into Cacti the performance is fine. I can view my graphs and all that seems fine. When I click on the Syslog tab it hangs for 2 - 5 minutes... The little IE circle keeps spinning (tried if FF as well). Eventually it comes up. After it gets there it seems to perform fine. It even seems pretty snappy. Searches and all that stuff go fine but if I close out of my browser and do the same it it happens all over again...

This was a problem on my old 8.7b box that I was running before and I was hoping it would get fixed with a fresh install. No dice. Other items, right now when I log into it shows that there is 1.5 million records in the last day (roughly 14 hours). I have a lot of gear dumping syslogs off to this thing. Could that be the reason it is so slow? Is that a lot of records for Cacti/Syslog? Is there another way to optimize this? Bugs out there?

Thanks in advance for your help,

Side Note - I did have the below error message coming up above the Cacti/Syslog screen after my intial install.

"Warning: include(./include/html/inc_timespan_settings.php) [function.include]: failed to open stream: No such file or directory in /var/www/html/plugins/syslog/syslog.php on line 126"

I just commented out line 126 and it went away... everything else seems to work well enough. I thought I would include this as it was related, although even with this error it was slow.

[armstrongzhao]

I have the same problem. I set up the syslog server using CactiEZ linux version. At the beginning, the syslog tab works very well. After having collected 4.5G syslog message, the syslog tab works very slowly. Just like yours. I believe that the separation of time and date in the table causes all this heartache. Your can try the CaMM. The time and date of the plugin are in the same table. Maybe it can improve the query.

By the way, the hardware should also be considered. The faster, the better.

[TheWitness]

Also, make sure you keep less data... But the date/time field piece is a major PITA. I should finish 5.3

TheWitness