Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials

Kiwi -> Orion

bbeachy2001

I have upgraded to Kiwi NG, and it seems to be working well - I have stuff pointed toward it, and the stuff shows up, but I'm trying to forward things on to my Orion Syslog instance. That was how I was told was the best way to set things up - point everything to the Kiwi server, then filter and forward the stuff you really want to the Orion Syslog server, which is easier to search.

However, it seems like since a while back (I'm assuming when I did one of the Orion upgrades), I now get NOTHING in Orion. I have rules in Kiwi set to forward stuff to Orion, and I've made sure the Orion server isn't blocking anything in the firewall, but I still get nothing.

Is there something I need to do in Orion now to get it to accept/show stuff that I am forwarding to it?

Find more posts tagged with

syslog

Accepted answers

All comments

mgebauer

Hello @bbeachy2001 ,

great to hear you are starting to use Kiwi NG. If you correctly configured Forward action to Orion server, I would recommend to install wireshark on the orion server and confirm the events are being forwarded from Kiwi to the Orion machine. It will help us to identify the place where the issue lies.

Thank you

bbeachy2001

Here is how I have the rule set in Kiwi - my Orion server is 10.101.101.101

I have wireshark on the Orion server, and I don't see any UDP traffic coming in from the Kiwi server...

vonzoom

I wonder if Orion is dropping it because your Kiwi server isn't a monitored node? I'm not sure how forwarding would show up to the Orion system so maybe it's not an issue, but you might check to see if your Kiwi IP is getting dropped as an unmonitored log sender.

ALERTS & SETTINGS | SYSLOGS | SETTINGS | MANAGEMENT | SHOW UNMANAGED LOG SENDERS

URL:
https://<<your.SW.instance.com>>/apps/orionlog/settings/log-management

mgebauer

In that case it may be issue in Kiwi.

Install wireshark in Kiwi server, that will answer whether the messages are being sent out.

You can review the log on following place or open ticket with support team and provide the log file for them:

C:\ProgramData\SolarWinds\KiwiSyslogService\logs