6 Replies Latest reply on Mar 12, 2009 2:04 PM by LTParis

    Cisco syslog service stopping

      So after a single sucessful try using Kiwi to forward syslog events to my SolarWinds server the service now just stops. The assoicated errors for this are:

      Event Type: Error
      Event Source: SyslogService
      Event Category: None
      Event ID: 1019
      Date:  3/11/2009
      Time:  7:55:29 PM
      User:  N/A
      Computer: SLR001
      Description:
      Port 514 on IP Address 0.0.0.0 is already open.  Change the 'LocalIPAddress' parameter in the configuration file to another IP address or port

      And

      Event Type: Error
      Event Source: NCMSyslogService
      Event Category: None
      Event ID: 1005
      Date:  3/11/2009
      Time:  7:48:11 PM
      User:  N/A
      Computer: SLR001
      Description:
      Syslog Service Unhandled Exception Cannot stop SolarWindsSyslogService service on computer '.'.
         at System.ServiceProcess.ServiceController.Stop()
         at NCMSyslogService.SWSyslogService.StopMyself()
         at NCMSyslogService.SWSyslogService.ListenForUDPPacket()
         at System.Threading.ThreadHelper.ThreadStart_Context(Object state)
         at System.Threading.ExecutionContext.Run(ExecutionContext executionContext, ContextCallback callback, Object state)
         at System.Threading.ThreadHelper.ThreadStart()

      And

      Event Type: Error
      Event Source: .NET Runtime 2.0 Error Reporting
      Event Category: None
      Event ID: 5000
      Date:  3/11/2009
      Time:  7:58:58 PM
      User:  N/A
      Computer: SLR001
      Description:
      EventType clr20r3, P1 ncmsyslogservice.exe, P2 0.0.0.0, P3 498a4b83, P4 system.serviceprocess, P5 2.0.0.0, P6 471ebf67, P7 a0, P8 c0, P9 system.invalidoperationexception, P10 NIL

      Any thoughs on a solution? I have .net 2.0/SP1, .net 3.0/SP1, and .net 3.5 installed on this machine.

        • Re: Cisco syslog service stopping
          Yann

          Hi,

          It seems that both Orion SyslogService and NCMSyslogService are running on your server. They are probably fighting to know which one can bind the UDP port 514.

          I would recommend you to disable the NCMSyslogService and see if that helps.

          In command line type:

          net stop SolarWindsNCMSyslogService

          sc config SolarWindsNCMSyslogService start= disabled



          Yes there is a space between the '=' and 'disabled'  ;-).

          HTH,

          Yann

            • Re: Cisco syslog service stopping

              No luck. It the service just starts/stops immediatly. Here is the entire process recorded by the solarwinds log service:

              • Syslog ruleset of 1 rules loaded from database at 3/12/2009 8:19:04 AM
              • Solarwinds Syslog Service Started
              • Error: Port 514 on IP Address 0.0.0.0 is already open.  Change the 'LocalIPAddress' parameter in the configuration file to another IP address or port
              • TCP Listening Disabled
              • Solarwinds Syslog Service Stopped
                • Re: Cisco syslog service stopping
                  Yann

                  Error: Port 514 on IP Address 0.0.0.0 is already open.

                  Could you check which application is binding the udp port 514?

                  in command line type:

                  netstat -abo > netstat_results.txt

                  review the text file and check which app is listening on the udp port 514.

                  By default the port number is named syslog.

                  here is an example of the line you need to check:

                  UDP    hostname:syslog   *:*   1664   [SyslogService.exe]

                    • Re: Cisco syslog service stopping

                      I don't know it's it's changed in newer versions, but all I saw was syslogd_service.exe:

                       

                      TCP    Server:3300         XVMSLR001.ofda.gov:0   LISTENING       1188
                        [Syslogd_Service.exe]

                      UDP    Server:1039         *:*                                    1188
                        [Syslogd_Service.exe]

                      UDP    Service:syslog       *:*                                    1188
                        [Syslogd_Service.exe]