Syslog Viewer not working.

Question

Change some of our routers to use this syslog server instead of TriGeo.  Viewer never displays any messages.  Also have Syslog Sender sending test messages and nothing.  Orion Syslog service is started.   I see traffic hitting the NCM server via packet trace.  This is in the event viewer:

Service Start Failure - Exception during Initialize Service SolarWindsSyslogService was not found on computer '.'.
   at System.ServiceProcess.ServiceController.GenerateNames()
   at System.ServiceProcess.ServiceController.get_ServiceName()
   at System.ServiceProcess.ServiceController.Stop()
   at NCMSyslogService.SWSyslogService.StopMyself()
   at NCMSyslogService.SWSyslogService.Initalize()

Service Start Failure
Unable to open main database.  Error:A connection was successfully established with the server, but then an error occurred during the login process. (provider: Shared Memory Provider, error: 0 - No process is on the other end of the pipe.)
Connection String:Data Source=(local)\SQLExpress;Initial Catalog=ConfigurationManagement;User ID=SolarWindsNPM;Password=*******;Connect Timeout=20;Load Balance Timeout=120;Application Name="Orion NCM Syslog Service";Workstation ID=BEACHNCCM01

For more information, see Help and Support Center at

Any ideas?

FormerMember · Answer

Ran the configuration wizard and created a new account for the SWL server.  Fixed.

FormerMember · Answer

Sniffed, it hits the server but appears the service is having a hard time starting.  We do not use the Orion product.

lchance · Answer

on your Orion server, if you type in NETSTAT -ANO and check the process using UDP port 514, does yours match the actual Orion Syslog service process or is it showing another one running on that server?

do you have a sniffer you can put on your Orion server to see that you're actually receiving UDP packets with port 514 traffic?