bkyle · Professional Servi ces Engineer

Are the syslogs being sent in the standard syslog format? Also what does a packet capture show?

The versions you mention CatTools 3.2.16 and Syslog Daemon 8.2.18 have not been tested with 2008. Here are the release notes for both: CatTools: http://www.kiwisyslog.com/products/kiwi-cattools/whats-new.aspx Syslog: http://www.kiwisyslog.com/products/kiwi-syslog-server/whats-new.aspx

If you try to relay a message from the CatTools system via telnet, can you use SSL/TLS?

Scott, If you have the unlimited license, and your maintenance stays current, you will keep the same license. There is not a way to add multiple licenses on one system (You would need an install for each license) There is not currently a way to link multiple servers under one console..

Are you also changing the IP address? Are you using SNMP as a communication type? If you are not using SNMP that credentials should still work. If you are using SNMP, and the IP address remains the same, you will want to make sure the remote systems are set to allow the IP address and not the original hostname.

Lionel, Can you enable capture mode, and post the contents of the debug file?

On the warn down and lost, I would not set it for less that 30 seconds, as this can give false positives. You can reduce the failures per alert to 2.

Make sure the dependency has a shorter polling interval that the monitors dependent on it.

is this issue specific to any operating system?

Abdul, You would need to configure your device to send syslogs to the Kiwi Syslog server. The syslog server is only a listener. We listen on port 514 for and syslog messages coming in, and then we process them.

NTM does not interact with Orion. It is stand alone. It should be able to store any community strings that you add.

Stephen, NTM uses SNMP as a primary source of information. If you she CDP neighbors from a Cisco device, do these LWAPPs show up?

Jacob, Currently the only option we have that may work for you is Every 1st day of the Month, or selected day(s) of the month.

What version are you guys looking for?

I the latest version 2.1.1, when you right click on a switch and select node properties, you will see a VLAN Data tab. If NTM was able to pull VLAN data, you will be able to see which ports are in which VLANs.

Adi, Try recreating the credential, and using it for a few monitors. See if that resolves your issue.

I would recommend using Variations, and go to the Additional Commands tab. Next check the Show Running Config box, and enter the correct command in the box.

As a test, please try creating the same user with the same password on both the remote system and the NTM system. Next, add the account to the administrator's group on both systems. Use this credential in NTM to scan.

I would not recommend using a version that was not included with setup file, as it has not been tested.

Are you seeing any errors in your errorlog.txt file?

If you can write a vbs script, you can call it with an external process monitor.

The device sees to be returning an admin prompt instead of a password prompt. we are looking for either: WFMDRetVal=1 Waiting for: "password:" WFMDRetVal=2 Waiting for: "login:" WFMDRetVal=3 Waiting for: "% Login invalid" WFMDRetVal=4 Waiting for: "% Authentication failed" but instead we are getting "admin" returned.

What Operating System is Kiwi Syslog installed on? Also are you using US English?

Please see Brandon's workaround here: Event Log Forwarder - Where is the Audit Failure Type?

Are your other event logs working ok?

Have you restarted the Kiwi Syslog service?

Depending on how you are trying to use auto-split, the free version may not work for you. Please see this link: http://www.kiwisyslog.com/free-vs-paid-edition.aspx

Nicolas, Is there another Nortel device that does support Variations that you can use until the Passport device has been updated?

Please see this link: Kiwi Syslog Server

By default Kiwi Syslog will log to a SyslogCatchAll.txt file. This file will continue to grow. You can use an AutoSplit value such as %DateISO, and this will give you a new file each day.