Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

Cannot write to log file

I am using the evaluation version but cannot get log messages from our routers to write to the specified log file or the display. I can write to the display and log when using the test option. In the error log i see "Service running, but Service/Manager comm link is not connecting" and "Unable to connect to Service socket on TCP port 3300"

IP connectivity is good, also I have tried restarting the service and rebooting my machine without any success.

Graeme

Find more posts tagged with

Accepted answers

igorvvv

Try the following:

- Reinstall Kiwi Syslog.

- run from DOS console (Start->Run->cmd) the command: netstat -aon

- find in the list the line: TCP 0.0.0.0:3300 ... and look for process ID (PID)

- check in TaskManager if this PID belongs to Syslog_Service.exe (if PID is not visible, activate it thru TaskManager->View->SelectColumns...)

- if it is it means that there is not problem with the port being blocked by another process as I suggested before. The problem might be with firewall or anti-virus program on your machine which block communication

All comments

bshopp

Can you check to see if any other app is using that port on that box?

igorvvv

If TCP port 3300 is used by another process on the system you can try to change the port Service/Manager use to communicate. To do this look at:

www.kiwisyslog.com/.../adv_reg_interapp_communication.htm

Restart the service/manager afterward.

GLyle

I have tried this but still nothing. I couldn't find the NTServiceSocket value so i created it but still does not work. I don't think anything else is using this port number as i was running the free version previously. Still seeing "Unable to open InterApp listening socket on TCP port 3300" in the error log when i try to update the setup function.

igorvvv

I have just checked that it works. InterApp port can be changed as was advised.

1. Close Manager if open.

2. Open regedit and navigate to ..\SolarWinds\Syslogd\Properties and create (if not exists) REG_SZ value NTServiceSocket and assign free TCP port to it (I tried 3578 and it was OK on my machine).

3. Go to: Control Panel->Administrative Tools->Services. Find Kiwi Syslog Service and restart it.

4. Check that port is open using e.g. Tcpview utility from SysInternals.

5. Open Manager and test.

GLyle

I have created the NTServiceSocket and gave it a string value of 3578 but still seeing these errors. I downloaded TCPview and i don't see that port in use anywhere else, or port 3300 either .

Looking at TCPview, the Syslogd_Manager.exe process is using TCP 4488 and Syslogd_Service.exe is UDP 548.

The remote address for Syslogd_Manager.exe is localhost:3578 but the Syslogd_Service.exe value is *.*

igorvvv

Try the following:

- Reinstall Kiwi Syslog.

- run from DOS console (Start->Run->cmd) the command: netstat -aon

- find in the list the line: TCP 0.0.0.0:3300 ... and look for process ID (PID)

- check in TaskManager if this PID belongs to Syslog_Service.exe (if PID is not visible, activate it thru TaskManager->View->SelectColumns...)

GLyle

Hi igorvvv

Firstly, thanks for your help with this issue.

I have uninstalled and re-installed Syslog. I ran the netstat -aon command but i don't see port 3300, i checked the error log and it is still using port 3578. I assume the registry entry was not removed during the install.

I looked at Task Manager to get the PID's for the Syslogd_service.exe and Syslogd_Manager.exe processes and checked them against the netstat output.

Syslogd_Manager

Protocol - TCP, Local address - 127.0.0.1:2467, Foreign address - 127.0.0.1:3578, State - SYN_SENT, PID - 3372

Syslogd_Service

Protocol - UDP, Local address - 0.0.0.0:514, Foreign address - *:* State - Blank PID - 5100

Protocol - UDP, Local address - 0.0.0.0:2125, Foreign address - *:* State - Blank PID - 5100

I had already allowed access for ports UDP 514 and TCP 3578 on the firewall, so i allowed access for the other ports but i am still seeing the same issue.

igorvvv

Please do the following in the command prompt:

- netstat –ano > netstat.txt

- tasklist > tasklist.txt

- tasklist /svc > tasklist_svc.txt

and attach created files into your reply (to add files use Insert Media button in tool bar).

Just in case if it is firewall issue you may look here (support.microsoft.com/.../875357)