Detecting Missing and Out-Of-Order Logs

Syslog Viewer keeps track of sequence numbers for incoming syslog messages. If Syslog Viewer detects missing or out-of-order messages, it generates "syslog.error" errors, for example:

12:45:49.057 10.4.219.224 syslog.error 10 messages are missing

Syslog Viewer also automatically handles packet reordering, using a variation of jitter buffer algorithm. Packet reordering should function smoothly, except for the first few messages from the specific source.

The following figure shows an example of a packet order issue (S=13, then S=11, and then S=14):

➢

To disable packet recorder compensation mechanism:

1.

On the toolbar, click the Options   icon; the Options dialog box appears.

2.

Under the Syslog group, clear the 'Compensate for packet recorder' check box.

3.

Click OK.