Syslog not getting logs

TehDuffman

I am trying to get the syslog portion of NPM configure correctly. I also have NCM installed (couldnt find its syslog service though)

I know that my syslog clients are sending correctly as I have tested them with Kiwi on the same server with it receiving logs. I also have them connected to another server and it recieves them when i send out tests. I have turned off the kiwi service and have done netstat showing only SyslogService.exe*32 listening on por 514. Using wireshark I can see the packets coming in and they look correct.

If i put syslog forwarding on the server and point it at itself it will receive syslog logs.

The only issue I have seen is that if i go into syslog viewer -> settings - > alerts/filter rules and click on all servers the only server listed in there is servername(169.254.73.214) in which the IP is obviously incorrect.

I have changed the IP in the config file to the correct IP but have not seen any change on service restarts or rebooting.

netlogix

oh, and just because, did you check windows firewall?  (sometimes easy things are just over looked)

I'd say trying disabling it in all three categories, and if it fixes it, then look around at the rules and make sure UDP 514 inbound for all three classes are enabled.