Syslog and Log Forwarder

The Log Forwarder works fine for me in that environment, although you may need to allow it through your windows firewall…

Thanks but I shut down the firewall entirely and I still can't get messages to the server and this is the second 2003 server I've seen this problem with.

I'm running it on several hundred servers with no issue. Are all the servers on the same subnet? 

Yes, both 2003 LF servers are on the same subnet as the Syslog host. The 2008 server is on a different/separate subnet but works as expected. Additionally, we have a Cisco ASA and a Ubuntu 12.04.02 Linux system all reporting to the syslog server with no issues. Something is different about 2003.....

How is your Log Forwarder configuration done?  Is the syslog server configured as an IP address or a hostname?  If a hostname, can you ping that hostname in the command prompt?  Are you filtering in the configuration or sending everything? Is there anything in the SolarWinds.net event log?

Syslog server is configured within LF as a FQDN, both name and IP ping successfully from a command line. As of now we are only sending system and security events. yes, 1 entry from last week in the SolarWinds.net event log, an error re: the configuration log not existing but would be created ( I have confirmed it is now there ).

I'd download the Kiwi Syslog Generator and use that to send some test messages from the 2003 servers.  That would rule out the connectivity and point the issue to the LF agent.  I can't find the link on the Solarwinds site but it's still on the Kiwi site( http://www.kiwisyslog.com/downloads.aspx). You could also get a packet capture to see if anything is being sent from the 2003 server to the syslog server.

If it is the LF agent is it running as the System account?  Are there any "unusual" security settings on the event logs?

Thanks for the advice and input, I'll try the Syslog Generator and see if that helps.