Recently, I built an application monitor and group in the SolarWinds Orion environment to keep a closer eye out for our Kiwi Syslog instances. It was a welcomed surprise when I noted a pre-built default for Kiwi Syslog, which monitors the service and TCP connections for up/down status.
Today, we noticed that the application monitor reflected a downstate on all Kiwi Syslog instances. When I set up our Kiwi Syslog instances, I used TCP port 443 instead of the defaults (80 or 8080). The first thing I checked was the websites that were up and running with up-to-date logging. After ruling out the server, IIS binding, and the Kiwi service(s), I thought maybe the issue was firewall-related. I ran a netstat -aon on each server, and TCP port 443 was present and listening. When I checked the Solarwinds Orion agent, I noticed that it was reporting for the default TCP port 8080. I changed the inherited values for the description and port to 443, and the polling was now reporting correctly.
Lesson learned: trust but verify.