This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.

You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

TCP Syslog Does Not Work in Latest Version

kduddy over 6 years ago

I use kiwi syslog server a lot for testing syslog. It seems like in the latest version there are issues with TCP. I'm verifying with the Kiwi Syslog Message Generator. Seems like with syslog server version 9.4.1 TCP connects and works, but in latest version 9.6.3 it does not connect for some reason. When I try to connect TCP with message generator it says "TCP session remotely disconnected" using the same tool the same exact way, it works with version 9.4.1. I'm using the syslog message generator tool on the same machine as the syslog server. Is this a known issue, or am I missing something? Any suggestions or help would be much appreciated. Thank you very much.

0 bkyle over 6 years ago

Did you export the config from the 9.4.1 version and import it into the 9.6.3 version?
Cancel
Vote Up 0 Vote Down

Cancel
0 kduddy over 6 years ago in reply to bkyle

No it's a complete uninstall of old version and install of new version.
Cancel
Vote Up 0 Vote Down

Cancel
0 kstone over 6 years ago

I created a forward rule from one of my production servers to my test server(approximately 700k MPH). The production server is 9.5.1.66, the dev server is 9.6.3.3.
The first configuration was using UDP on port 514. This worked as expected, messages were received and logged. The second config was using TCP on port 1468. This did not work. No messages were received from the prod server.
I then specifically added the IP address of the dev server to the 'Bind to Address' box and applied the config. This did work with messages being received and logged on the dev server.
This still would be a bug as the documentation states that the TCP socket will bind to all interfaces and it appears that it does not.
Cancel
Vote Up 0 Vote Down

Cancel
0 bkyle over 6 years ago

If you run netstat -ao from a command line, is Kiwi Syslog bound to port 1468.
Cancel
Vote Up 0 Vote Down

Cancel
0 kduddy over 6 years ago in reply to bkyle

Captured screenshots for both 9.4 and 9.6. Seems like there is an issue with 9.6. UDP still works, but seems to be a problem with TCP.
Cancel
Vote Up 0 Vote Down

Cancel
0 kduddy over 6 years ago in reply to kduddy

And status bar of Message Generator also says "TCP session remotely disconnected"
Cancel
Vote Up 0 Vote Down

Cancel
0 kduddy over 6 years ago in reply to kduddy

Also, if you see the output of the netstat command with 9.4 and 9.6. Seems like with 9.6 it does not establish a connection to the port 1468.
Cancel
Vote Up 0 Vote Down

Cancel
0 kduddy over 6 years ago in reply to bkyle

I use the kiwi syslog server free (version 9.6) and I only have an older evaluation full (version 9.4). So once that expires I can't use the older version for TCP anymore. Is this a known bug? Can anyone else get the latest version to work with TCP? Is there anything else I can provide that can help with troubleshooting this issue?
Cancel
Vote Up 0 Vote Down

Cancel
0 bkyle over 6 years ago

If you notice, in the first screenshot, you can see where 1468 is bound to a specific PID 3672, but in the second screenshot, 1468 is also bound to PID 0, which is a system process ID.
Cancel
Vote Up 0 Vote Down

Cancel
0 kduddy over 6 years ago in reply to bkyle

Also in 2nd screenshot 1468 is bound to PID 0, which also is in a TIME_WAIT state and nothing in 2nd screenshot with port 1468 is in an ESTABLISHED state.
Cancel
Vote Up 0 Vote Down

Cancel