Hi,
in kiwi syslog server there is an email notification which breaks down all the syslog messages by the sending hosts and create a top 20 list of the most active hosts. These count (20) is hard coded and not changeable by the user. In medium environments with some ESXi-Hosts, Cisco Catalyst and Cisco Nexus switches the hard coded value is not high enough to show the top active hosts/switches. It should be possible to configure this value by the user.
best regards,
franki