Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

Event Log Forwarder not sending data on some servers

Hey Community,

I have recently installed a trail version of the new Kiwi Syslog Server NG Version 1.0.0.24 and installed the Event Log Forwarder 1.2.0.114 on my servers.

All servers are in same VLAN and I have tried on 2012r2 / 2016 / 2019 / 2022.

Some servers are sending data and some servers are not. Using UDP 514

I have no errors or anything to troubleshoot on

What am I doing wrong?

Best regards

Carsten

Find more posts tagged with

Accepted answers

All comments

mgebauer

Hello @Small-IT ,

I would recommend to install wireshark and confirm sending/receiving of the messages. That will disclose which app to be investigated deeply.

Small-IT

Hey mgebauer

Thanks for your reply

Our application protection system won't let me install WireShark.

The Firewall/network settings are identical on all servers, so it makes no sense that it works on some servers and not others.

It also doesn't matter what Windows server version it is and all servers are patched and updated.

What is the difference in the two installation files

SolarWinds_Event_LogForwarder_Setup - Application and Windows Installer?

They both seem to run the same setup options.

Do you have any other idea on how to troubleshoot?

Small-IT

Are there maybe some specific roles or features that need to be installed?

Or speciel network settings?

mgebauer

I dont have knowledge about log forwarder, but is it difference between application and service mode?

Small-IT

OK, found a soloution. - I did several different things, so I am not really sure what did the difference.

First of all, I ended up using the Application installer and not the Windows Installer file. - Installed it with right click and Administrator mode (Even though I am Domain Admin)
The other servers that was already working was installed with the Windows Installer file, but the Application installer is obviously working better, at least for me.

Then I entered the Syslog server information

And then Configured Subscriptions. Here I only started with (Application, Hardware, Security and System) and Kernel

Then I finished the setup and the forward was working.

After the installation and configuration was completed, I Edited the Subscriptions and added all the logs I wanted forwarded.