Syslog messages not coming in

Hello.

I have NPM running, but i cannot get syslog messages from some of the routers on my network in NPM, i only have a few routers that i recieve syslog messages from, but when i configure another syslog server i am able to receive the messages, my question is, do i need to specify in NPM which devices are allowed to send syslog messages or when i point my router to the NPM server then thats it? if i need to do configurations in NPM then how do i do that?

regards.

Find more posts tagged with

syslog

npm

Accepted answers

branfarm

Another item to check would be if the IP you're using to manage the router is the same as the source interface from which the router sends the syslogs. I've had issues with this in the past. For example, if you're using the loopback address to manage the device, ensure that the syslogs are sourced from the same loopback address.

All comments

mharvey

There is no configuration that needs to be done in NPM to receive syslog messages. The Orion Syslog service is a listening service and should be receiving anything that is reaching the server. Are the devices managed routers in Orion in terms of polling? Are you able to get other SNMP information or ping those routers from the server? Are there any rules dropping syslog messages that don't meet specific criteria?

Regards,

Matthew Harvey

branfarm

simonplexxi

When I had problems getting Syslog to work, the first thing I did was to use wireshark on the NPM server to verify that the syslog packets were being received. If the packets are getting to the NPM server, then something is blocking them, in my case Windows Firewall.

If they are not being received then you know its not an NPM issue.

RichardLetts

What others have said, plus: check windows firewall allows incoming UDP/514 from any source (or at least those IP addresses on your network)

vnkhwazi

Thanks Branfarm.

This was exactly the problem, i just changed the IP address to the polling address and the syslog messages started coming in.

superfly

There's an easier way. Just open Syslog Viewer on the Solarwinds server and see if your syslog messages are coming in. If they are then all is good. If not, then the device is not sending them correctly or it's getting blocked upstream.

The OP had the syslog messages coming in but as the IP addresses differed, the information was not populated within NPM. Source IP of the syslog message needs to be the same as the monitored device's IP in NPM otherwise they don't match up.