nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

Can't see any Syslog on NPM

greenamit

Hi,

I installed NPM 10.1 for trial and playing with it for 10 days now. Our impression is very positive!

We encounter a problem though - we are not getting/seeing any syslog messages.

I checked and the SolarWinds Syslog service is running. I checked using wireshark and we receive syslog messages on NPM server (UDP:514).

I checked using netstat -aon and it seems the services is "listening" to UPD 514 but still - no messages via the web console nor the Syslog Alert application.

I checked using the Database manager the Syslog table and it's empty.

I tried to find in the manual if we should do anything that we haven't done but couldn't find anything new.

We will appreciate if you could help.

Thanks,

Amit

Find more posts tagged with

Accepted answers

greenamit

I had SE support and he identified the problem. Pasting here his find:

Hi Amit,

Can you check the Security Event log on the Orion server.
I am seeing a huge number of Failure Audits. Windows Filtering Platform is blocking hundreds of packets, including Syslog and some SNMP.

Looks like you are correct that the Syslog Messages are making it as far as the Orion server, but getting blocked by Windows Filtering.

Can you maybe stop the Base Filtering Engine(BFE) service and then check to see if syslogs are received.

Windows Filtering platform :
http://www.microsoft.com/whdc/device/network/wfp.mspx

Let me know if this resolves the issue or not.
Thanks!

Mark

All comments

mcbridea

Use this procedure to check that UDP 514 is open. http://knowledgebase.solarwinds.com/kb/questions/1229/Why+don%27t+I+see+messages+in+my+SysLog+server%3F

greenamit

Hi Andy and thanks for your reply.

This is what I've done. I've seen SyslogService.exe is listening to 514 on the NPM server.

I also checked using WireShark to see that syslogs are being received at the NMP server via UDP/514, but still, nothing shows up in the Syslog Alerts nor the Web console.

mcbridea

Well, I'm out of ammo. I'll mark this for someone to assist but it will probably not be until tomorrow.

Andy

kevinf

Good morning,

One thing I always make a mistake on and constantly have to recheck is this: You have to turn the NCM Syslog service off or the Solarwinds (NPM) Syslog won't work. It wasn't said anywhere in this thread so I thought I'd add to it.

Kevin

greenamit

I actually uninstalled NCM as it wasn't necessary so we left with only the NPM Syslog service.

bshopp

Hard to tell further without seeing what the box looks like. Are there any other syslog services installed? I am going to have an SE reach out to you to assist in investigating.

sedmo

It might be interesting to use the Orion Service Manager to stop the syslog service and then verify that nothing is listening on udp/514 with netstat. That might help you determine if you have more than one service trying to use udp/514.

Another thought would be to check the Syslog Viewer app and verify that there are no rules setup that are discarding the incoming messages.

greenamit

I stopped the SolarWinds Syslog Service and then checked using netstat to see it anything else is listening to 514 but nothing came up.

1. Does the Syslog Viewer display only syslogs of devices being managed (discovered and monitored) by NPM or any syslog it receives?

2. No filters/rules been defined in the Syslog Viewer. Default settings as it comes out of the box.

Thanks

netlogix

Just to make sure, you did configure the remote device to send in logs right?

For Cisco, you could use something like:
logging monitor notifications
logging source-interface Loopback0
logging x.x.x.x

Were x.x.x.x is the IP address or the Orion Server. Also, use "show logging" to see if switch/router is sending logs (out put like):
Syslog logging: enabled (0 messages dropped, 2 messages rate-limited, 0 flushes, 0 overruns, xml disabled, filtering disabled)
    Console logging: level debugging, 71 messages logged, xml disabled, filtering disabled
    Monitor logging: level notifications, 0 messages logged, xml disabled, filtering disabled
    Buffer logging: level debugging, 71 messages logged, xml disabled, filtering disabled
    Logging Exception size (4096 bytes)
    Count and timestamp logging messages: disabled
    Persistent logging: disabled
    Trap logging: level informational, 75 message lines logged
        Logging to x.x.x.x (udp port 514, audit disabled, authentication disabled, encryption disabled, link up),
              75 message lines logged,
              0 message lines rate-limited,
              0 message lines dropped-by-MD,
              xml disabled, sequence number disabled
              filtering disabled

(sometimes the easy things are looked over)