bkyle · Professional Servi ces Engineer

Can you enable capture mode (File\Enable capture mode), and post the contents of the debug file (located in your \CatTools3\Debug folder). Prior to posting, please remove and sensitive data.

You can try the Device.CLI.Send commands activity, this will allow you to send multiple commands.

Ken, I would start by disabling the Windows UAC, and any antivirus software on the Kiwi Syslog system. We can see the syslogs at a packet level. This could be an issue where the syslogs are not getting processed by the Kiwi Syslog server.

I would recommend using a maintenance schedule. You will not need a script, and you can set start and stop times.

The Error Number: 91 is a VB error. Try reinstalling Kiwi Syslog over the top of your current install. Run the install as the local administrator (not a domain account), and make sure both the Windows UAC and any antivirus software is disabled.

From the command line type the following: netstat -aon | findstr ":162" This will let you know is anything is bound to port 162

Nass, What is the exact version that you are wanting to install?

This will require a script update. I would recommend creating a feature request: Kiwi CatTools Feature Requests

I would enable capture mode (File\Enable capture mode), and run the activity. You will find your capture files in the \CatTools3\debug folder. This will show you the connection issue.

Have you tried the Device.CLI.Send commands activity? See this link: SolarWinds CatTools

Alfred, You may not need RegEx. Post a screen shot of the syslogs that you are wanting to include.

There is not currently a way to set this up. You may want to submit a feature request.

I would recommend looking at Universal Device Tracker: Device Tracker and Switch Port Management | SolarWinds

Starting with version 9 of ipMonitor, a monitor has to be added to a device. You will want to open a device, and then you can add your monitor. Please see this screenshot:

Dina, Please see this link: Adding devices to the Kiwi Syslog free version

If you enable capture mode (File\Enable capture mode) you can see verbose communication with your device.

Are you looking for a text file or the html format?

Eric, You can install 9.4.1 over the top of y our current install.

CatTools is seeing myswitch# as the hostname. You may need to use Variations to set the prompts to use that name.

Try following the steps in this link: https://thwack.solarwinds.com/docs/DOC-187351

Have you done a packet capture on both to compare incoming packets?

Does a Wireshark capture show the messages reaching the Kiwi Syslog server? Also does a Wireshark capture show the messages leaving the system where Log Forwarder is installed?

You can try using our Variations feature: SolarWinds CatTools You may also want to open a case with us, and see about getting this device added to CatTools. YOu will want to see this link: SolarWinds Knowledge Base :: Get Support For Devices Added to CatTools

Are you adding groups, devices, or individual monitors to your alerts?

Robert, Did you add the registry entry prion to importing the rules? Also, if both systems (the original Kiwi system, and the new one) are running a 64 bit OS, you can try exporting and importing the HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\SolarWinds\Syslogd\Rules registry key. I would suggest exporting your entire…

Try restarting the Kiwi Syslog service. If that does not help, post a screenshot of the registry value that you added.

Two quick questions: 1. Does a Wireshark capture show packets coming in from these devices? 2. Have you confirmed that Kiwi Syslog server is listening on port 514?

There is not a direct import method. The two applications use different methods to store devices.

If you edit the activity, what is the path to the report file? Also what account is the CatTools service running under?

Jon, If you only need 30 days worth of logs, you can use an auto-split value such as %HostName. I would not recommend using log file rotation when using an auto-split value. You can use a schedule to clean up files older that 30 days.