Cisco syslog service stopping

So after a single sucessful try using Kiwi to forward syslog events to my SolarWinds server the service now just stops. The assoicated errors for this are:

Event Type: Error
Event Source: SyslogService
Event Category: None
Event ID: 1019
Date:  3/11/2009
Time:  7:55:29 PM
User:  N/A
Computer: SLR001
Description:
Port 514 on IP Address 0.0.0.0 is already open. Change the 'LocalIPAddress' parameter in the configuration file to another IP address or port

And

Event Type: Error
Event Source: NCMSyslogService
Event Category: None
Event ID: 1005
Date:  3/11/2009
Time:  7:48:11 PM
User:  N/A
Computer: SLR001
Description:
Syslog Service Unhandled Exception Cannot stop SolarWindsSyslogService service on computer '.'.
   at System.ServiceProcess.ServiceController.Stop()
   at NCMSyslogService.SWSyslogService.StopMyself()
   at NCMSyslogService.SWSyslogService.ListenForUDPPacket()
   at System.Threading.ThreadHelper.ThreadStart_Context(Object state)
   at System.Threading.ExecutionContext.Run(ExecutionContext executionContext, ContextCallback callback, Object state)
   at System.Threading.ThreadHelper.ThreadStart()

And

Event Type: Error
Event Source: .NET Runtime 2.0 Error Reporting
Event Category: None
Event ID: 5000
Date:  3/11/2009
Time:  7:58:58 PM
User:  N/A
Computer: SLR001
Description:
EventType clr20r3, P1 ncmsyslogservice.exe, P2 0.0.0.0, P3 498a4b83, P4 system.serviceprocess, P5 2.0.0.0, P6 471ebf67, P7 a0, P8 c0, P9 system.invalidoperationexception, P10 NIL

Any thoughs on a solution? I have .net 2.0/SP1, .net 3.0/SP1, and .net 3.5 installed on this machine.

Find more posts tagged with

cisco_syslog

kiwi_syslog

Accepted answers

All comments

Yann

Hi,

It seems that both Orion SyslogService and NCMSyslogService are running on your server. They are probably fighting to know which one can bind the UDP port 514.

I would recommend you to disable the NCMSyslogService and see if that helps.

In command line type:

net stop SolarWindsNCMSyslogService

sc config SolarWindsNCMSyslogService start= disabled

Yes there is a space between the '=' and 'disabled' ;-).

HTH,

Yann

LTParis

No luck. It the service just starts/stops immediatly. Here is the entire process recorded by the solarwinds log service:

Syslog ruleset of 1 rules loaded from database at 3/12/2009 8:19:04 AM
Solarwinds Syslog Service Started
Error: Port 514 on IP Address 0.0.0.0 is already open. Change the 'LocalIPAddress' parameter in the configuration file to another IP address or port
TCP Listening Disabled
Solarwinds Syslog Service Stopped

Yann

Error: Port 514 on IP Address 0.0.0.0 is already open.

Could you check which application is binding the udp port 514?

in command line type:

netstat -abo > netstat_results.txt

review the text file and check which app is listening on the udp port 514.

By default the port number is named syslog.

here is an example of the line you need to check:

UDP hostname:syslog *:* 1664 [SyslogService.exe]

LTParis

I don't know it's it's changed in newer versions, but all I saw was syslogd_service.exe:

TCP Server:3300 XVMSLR001.ofda.gov:0 LISTENING 1188
[Syslogd_Service.exe]

UDP Server:1039 *:* 1188
[Syslogd_Service.exe]

UDP Service:syslog *:* 1188
[Syslogd_Service.exe]