Showing results for 
Search instead for 
Did you mean: 
Create Post
Level 7

Windows Event Log Forwarder - service failed to start on Windows 2003 SP2


We have many servers that after installing and configuring Windows Event Log Forwarder the service is not able to start reporting following error message:

Service Control Manager
Event ID: 7000

The SolarWinds Windows Event Syslogger service failed to start due to the following error:
The service did not respond to the start or control request is a timely fashion.

Version of the Orion Windows Event Forwarder: 1.0.2055.28085.

I tried to reinstall the product and / or start the service manually - that did not resolve the issue for all of the servers (Windows 2003 SP2) but only for some.

Please help.


0 Kudos
18 Replies
Level 9

Are you guys running with an Internet proxy?
I had similar issues - the following seemed to work for me to fix the issues -
Add the following to your local hosts file in c:\windows\system32\drivers\etc\hosts wpad CRL.THAWTE.COM

if you're running Windows 2000/2003 run -
"proxycfg -u"
from a CMD prompt to ensure your Internet proxy settings are copied correctly from IE into the WINHTTP proxy settings - the solarwinds forwarder seems to want to check it's .Net certificate or something - doing these changes has made the forwarder work reliably.  This was for the older version - I havn't noticed if the newer version still has this issue...

Additionally I noticed on some boxes the service would fail after reboot - these settings helped fix that too  - although these days I use the Application monitor to ensure the forwarder service is running on all out boxes...  I also would set the service to restart if it fails.

Hope this helps!

0 Kudos
Level 8

Hi All,

 Im am getting this exact same message, windows 2003 ENT, SP2.

I have tried reinstalling the addon a few times and seaching for another solution with no luck.

 anyone found a solution to this or is able to help?

0 Kudos

Ok doing some testing:

 Windows 2003 SP2 - no good

Windows 2003 SP1 - installed and running.

Windows 2000 server SP4 - installed and running.

Windows XP SP2 - installed and recieving alerts

 There is no port blocking enabled so its no that, i have full admin rights on all services so its not that...

Tested it on several different Windows SP 2 machines and they worked! meaning its down to these few servers... all having similar properties, they are all web servers with SQL installed.

could be somethign using that port already... going to check using the TCP port viewer from microsoft and will update post.

0 Kudos

I have this running on several 2003 SP2 machines... no problems. The TCP port conflict sounds like a viable possiblity. Are these boxes 32-bit or x64?

0 Kudos

all Windows 2003 SP2 - 32bit 

0 Kudos

Ok having a bit of a hard time finding out what port this software uses... i found a forum saying that syslog or solarwinds uses port 514? checked and nothing is running on that port.

Can also confirm im running a windows 2003 ent SP2 box. It has SQL, IIS, .Net, Solarwinds on it, nothing else. so its no like we are doing anything special...

For the record this is the only machine in our entire network now that is having the issues.... and its the solarwinds host.

Is that the same machine you are having issues with Qwiati?



I have a few things to try still if anything works will let you know.

0 Kudos

This is what I found about that error-


You might try Snare..

0 Kudos

Hmm, seems a bit strange we need to use a 3rd party tool again to monitor events.

 would still like to find out why this isn't running on this box where as it works on all others.


Is there a way you can configure a rule in orion to email you if a service doesn't start? i guess i can just write a script to email me if service fails... thats a solution, nasty but works.

and its only on this SQL 2000 SP4, Windows 20003 32bit, ent SP2, box. which also runs solarwinds orion.

0 Kudos

 Have you downloaded the New WEF released last week?


Also you may try an Add/Remove -> Change -> Repair to see if that helps. 

0 Kudos

Yeapers, tried that, and downloaded the latest version yesterday.

Also did a repair and tried to start the service via CMD prompt (sometimes works...)


Im creating a VM of the server now so i can test it on a new machine and different service pack levels.

0 Kudos

 I have some progress here.... when setting the service to run as the service is starting fine on all servers.

When setting up service account which is domain admin and set run as on the service the service is failing again...


0 Kudos

The strange thing here is I have one server where this was not working but have not had the time to lookat it yet (Windows 2003 SP2) and this is only running IIS as the aditional Solarwinds Web Service, However it is also a domain Controller.

There might be something in that. 

0 Kudos


Build a new machine installed the same services and service packs and bam... same issue.

Windows 2003 SP2
 SQL 2000 - SP4
IIS Windows
Solarwind / Orion


I am going to remove the SQL services and check again, then IIS.

0 Kudos

I do not think it is the SQL as I have a Windows 2003 Server SP 2 running SQL Server 2000  with no issues. However it is not running IIS.

My SW Poller is Running Windows 2003 SP and IIS and I also have not issues.

The Windows 2003 Server SP 2 I am having issues with is the one running as a Domain Controler albeit running IIS for aditional SW Web Server. 

0 Kudos

All righty the following combo's:

 Windows 2003 ENT SP2 (assuming all windows patches installed), nothing else installed. - Installs.

Windows 2003 ENT SP2 (assuming all windows patches installed), SQL 2000 SP4 - Installs.

Windows 2003 ENT SP2 (assuming all windows patches installed), IIS - Installs

Windows 2003 ENT SP2 (assuming all windows patches installed), IIS, SQL 2000 SP4 - Installs.

Windows 2003 ENT SP2 (assuming all windows patches installed), SQL 2000 SP4, IIS, SW Orion - Fails.

There is something about having all 4 of these services on this box that stops it... i tested it at all stages and it wasn't untill i had all these online that it didnt want to install/start.

Now for SW orion to be installed it needs:

1. A Database server

2. IIS services.

Im starting to think it could be a issue that because its my SYSLOG monitoring server maybe its not able to have the push service installed on it as well? having stopped the syslog service, will the windows syslog push service start? no...

My SW Poller is Running Windows 2003 SP and IIS and I also have not issues.

Same as above except you have SW poller, does this include the Syslog service? i would be interested to hear if anyone has "Solarwinds Syslog Service" and "Windows Event Forwarder" Running on the same BOX.

I believe this would be the combo that makes the service stop.

0 Kudos

For the information asked for my Windows 2003 Server running Orion is running all Orion Servers including Syslog and Trap Services. However it is not running SQL as that is on a seperate box.

I see how this is only going to cloud the issue as there seems to be no instances the same.

0 Kudos

Having no helping response from Solarwinds Technical Support
and really no movement on this forum, the decision was made to abandon Solarwinds
Windows Event Forwarder and install 3rd party application to do this
same job – actually do this job properly, which means work.

I have found small open source Syslog Agent which can be
installed on any windows computer and runs as a service sending Events to Orion
Syslog server.

All need to be done is to just install the agent and
configure registry key to work with Orion Syslog – set server IP address.

The program is called winlogd.exe and I have successfully deployed
/ installed on all Windows Servers (including servers having problems working with Event Forwarder) in our Organization.

Is that going to be only solution when we will start getting
problems with rest of the Solarwinds products we are using?


0 Kudos

most of the servers with this issue are citrix ones and there are few with sql 2005 installed too...  

0 Kudos