Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials

Kiwi Syslog on 2008 R2 server, receiving syslog events, events not displaying

New install of 9.4 on newly repurposed HW running 2008 R2 (physical server). Netstat -ah shows the server is listening on UDP 514, packet capture reveals UDP 514 packets hitting the server's NIC, Kiwi settins confirm input port set to UDP 514, but no events are displayed in the console or are in the log files. Can't telnet over UDP to confirm the Netstat info, anyone have any ideas? Thank you,

Steve Miller

City of Renton

Find more posts tagged with

Accepted answers

All comments

Aforsythe

You can use wireshark to see if the server is receiving syslog traffic. Make sure it's not blocked in the firewall, and make sure you're not using any filters that would filter out your traffic.

hammondo

I used Wireshark to do the packet capture that I mentioned - the server's NIC is receiving the syslog packets from the syslog source. I have another install of Kiwi on a different 2008 R2 server (this one is a VM) and compared the NIC settings of the two servers side by side - there is no difference aside from the server IP address. There is no firewall on the server just AV and I've checked the AV product's logs and there is no indication the AV product is blocking anything.

Aforsythe

Hrm... I think I read somewhere that 2008 has some anti-spoofing options that you can disable via PowerShell scripts. If you're getting forwarded Syslog messages from another source spoofing the originating IP address, then this might be the issue. It's actually possible this could be the issue anyway.

I'll see if I can find that object property.+-

garetht

What rules do you have in place in Kiwi Syslog? Silly though it sounds, it's possible you might be discarding them, or just not telling Kiwi to display them.

hammondo

I left the rules at the defaults - they incolud just two 1) Rule: Default; Type: Action; Name: Display; Type: Display 2) Rule: Default; Type: Action; Name: Log to file; Type: Log to file. In Rules>Actions I have two items 1) Display where Display number: Display 00 (Default) and 2) Log to file where the Path and file name of log file, and Kiwi format, are at the defaults.