12 Replies Latest reply on May 2, 2010 4:09 PM by igorvvv

    Cannot write to log file

      I am using the evaluation version but cannot get log messages from our routers to write to the specified log file or the display.  I can write to the display and log when using the test option.  In the error log i see "Service running, but Service/Manager comm link is not connecting" and "Unable to connect to Service socket on TCP port 3300"

      IP connectivity is good, also I have tried restarting the service and rebooting my machine without any success. 


        • Re: Cannot write to log file

          Can you check to see if any other app is using that port on that box?

          • Re: Cannot write to log file

            If TCP port 3300 is used by another process on the system you can try to change the port Service/Manager use to communicate. To do this look at:


            Restart the service/manager afterward.

              • Re: Cannot write to log file

                I have tried this but still nothing. I couldn't find the NTServiceSocket value so i created it but still does not work. I don't think anything else is using this port number as i was running the free version previously.  Still seeing "Unable to open InterApp listening socket on TCP port 3300" in the error log when i try to update the setup function.

                  • Re: Cannot write to log file

                    I have just checked that it works. InterApp port can be changed as was advised.

                    1. Close Manager if open.

                    2. Open regedit and navigate to ..\SolarWinds\Syslogd\Properties and create (if not exists) REG_SZ value NTServiceSocket and assign free TCP port to it (I tried 3578 and it was OK on my machine).

                    3. Go to: Control Panel->Administrative Tools->Services. Find Kiwi Syslog Service and restart it.

                    4. Check that port is open using e.g. Tcpview utility from SysInternals.

                    5. Open Manager and test.

                    1 of 1 people found this helpful
                      • Re: Cannot write to log file

                        I have created the NTServiceSocket and gave it a string value of 3578 but still seeing these errors.  I downloaded TCPview and i don't see that port in use anywhere else, or port 3300 either . 

                        Looking at TCPview, the Syslogd_Manager.exe process is using TCP 4488 and Syslogd_Service.exe is UDP 548.

                        The remote address for Syslogd_Manager.exe is localhost:3578 but the Syslogd_Service.exe value is *.*

                          • Re: Cannot write to log file

                            Try the following:

                            - Reinstall Kiwi Syslog.

                            - run from DOS console (Start->Run->cmd) the command: netstat -aon

                            - find in the list the line: TCP ... and look for process ID (PID)

                            - check in TaskManager if this PID belongs to Syslog_Service.exe (if PID is not visible, activate it thru TaskManager->View->SelectColumns...)

                            - if it is it means that there is not problem with the port being blocked by another process as I suggested before. The problem might be with firewall or anti-virus program on your machine which block communication

                              • Re: Cannot write to log file

                                Hi igorvvv

                                Firstly, thanks for your help with this issue.

                                I have uninstalled and re-installed Syslog.  I ran the netstat -aon command but i don't see port 3300, i checked the error log and it is still using port 3578.  I assume the registry entry was not removed during the install.

                                I looked at Task Manager to get the PID's for the Syslogd_service.exe and Syslogd_Manager.exe processes and checked them against the netstat output.


                                Protocol - TCP,  Local address -, Foreign address -, State - SYN_SENT,  PID - 3372 


                                Protocol - UDP,    Local address -,     Foreign address - *:*            State - Blank        PID - 5100

                                Protocol - UDP,    Local address -,     Foreign address - *:*            State - Blank      PID - 5100


                                I had already allowed access for ports UDP 514 and TCP 3578 on the firewall, so i allowed access for the other ports but i am still seeing the same issue.