Multiple syslog instances on same server?

Question

My company is licensed for the Engineer's Tool Set, OrionNPM, and NCM, all of which provide syslog capabilities.
All applications are installed on a dedicated server (Windows 2K3, dual NICs) and connect to a separate server running SQL 2005 Std. SP2  (also Win 2K3, dual NICs)

Is there any way to run another syslog instance on this server?  Ideally, we would like to keep router logs apart from server logs, but are reluctant to purchase another dedicated syslog server (i.e. Kiwi) due to budget restrictions.
If anyone has been successful in overcoming these challenges, please post any suggestions you have.
Thank you in advance for your help and recommendations.

sstodulski · Answer

Thank you ICHANCE and YANN for your suggestions.

We were successful this morning, and the steps taken were pretty much in line with this thread:

The 'trick' was to first stop and disable the NPM's syslog service, then run the NCM configuration utility, which allowed for the installation of NCM's syslog server.

We modified the NPM's syslog config file to use a different port, restarted the NPM's service again.  As soon as the applicaiton launched, the entries were immediately seen.  (now, all we have to do is figure out how to add that second syslog link in Orion's menu bar, which I am working on now)

Thanks again for your help.  We really appreciate it!

Yann · Answer

Hi,

This thread might help you: Change Syslog Server port?

R,

Yann

lchance · Answer

The service running on the server which provides this capture of SYSLOG messages 'listens' on UDP port 514. Only a single SYSLOG service has access to this port data at one time, there can not be others. One SYSLOG service would have to stop and allow another vendor's SYSLOG daemon/service to capture packets off that same incoming 'listening' port.

If you will type NETSTAT -ANO at a command line on your server to find UDP 514 and check that Process ID which is in the rightmost column - mine looks like this:

UDP    0.0.0.0:514            *:*                                    2412

2412 is my server's syslog Process ID and if I look into Task Manager's list of Processes for PID 2412 I can see it comes from "SyslogService.exe" which belongs to Solarwinds. If you wanted to use Kiwi instead then you would see that vendors .exe name. I've used Kiwi before and I think there name is just "Syslog.exe.".

If you have a SYSLOG product and also a device that will send the SYSLOG packets with a different port number, say 515, then you could have something like Solarwinds working on port 514 and Kiwi on 515 and this might meet your needs. Good Luck!