This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.

You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

Kiwi Syslog not receiving any message

athena over 9 years ago

Hello,

I just installed Syslog on a Windows 8 VM (ESXi 5.5).

However... I don't received any message from the router (Cisco RV042G) I want to log.

I tried the generic troubleshhoting :

• Check network connectivity by pinging from the sending device to the Syslog Server machine => OK
• Check only one instance of Kiwi Syslog Server is running (Ctrl-Shift-Esc to get the task-list) => OK, only one
• Disable any personal firewall software such as ZoneAlarm or BlackIce => Disabled

• Use a sniffer to check if messages from the routing are reaching the PC => Yes, I can see them
• Check DNS resolution is working as expected by pinging a hostname from the Command Prompt => OK
• Check that there is a "Display" action setup for the facility and level you are expecting to receive messages on. => OK
• Send a test message to yourself by pressing Ctrl+T => Displayed
• Download a copy of the Free Syslog Server Message Generator (SyslogGen) from: www.kiwisyslog.com/downloads => Done
• Install SyslogGen and set it to send a message every second to the address 127.0.0.1 (local host). => Not displayed, and I don't see them in a local packet capture.
• Try sending messages with SyslogGen from another machine to the host running the Syslog Server => Not displayed, but see them on a packet capture (on Syslog PC)

Do you have any idea about the cause of this issue ?

Thanks in advance for your help.

Top Replies

0 bkyle over 9 years ago

Are you seeing syslogs from any devices in Kiwi Syslog server on this system?
Cancel
Vote Up 0 Vote Down

Cancel
0 athena over 9 years ago in reply to bkyle

I have only 1 source of logs.
Yesterday, I tried to install Kiwi on another PC (not a VM), and I have the same result.
No log registered from the router (but I can see the packets with a sniffer), and I don't receive local messages from SyslogGen (local or remote).
And, of course, the Windows Firewall had been disabled.
I think I missed something in the Syslog configuration.
Is theresomething specific to configure after installation (on the Syslog side) ?
Cancel
Vote Up 0 Vote Down

Cancel
0 bkyle over 9 years ago in reply to athena

From a Windows command prompt run the following command:
netstat -aop udp
Next check in task manager to see which application is listening on port 514 by checking the PID.
Cancel
Vote Up 0 Vote Down

Cancel
0 athena over 9 years ago in reply to bkyle

The answer is : Syslogd_Service.exe
Same result with SyslogGen : nothing...
Cancel
Vote Up 0 Vote Down

Cancel
0 bkyle over 9 years ago in reply to athena

If Kiwi Syslog is running as a service, restart the service and then test to make sure it is still listening on port 514.
Cancel
Vote Up 0 Vote Down

Cancel
0 athena over 9 years ago in reply to bkyle

Done and checked (Ping the service and Show service state => OK).
But still unable to receive any log message from SyslogGen.
Cancel
Vote Up 0 Vote Down

Cancel
0 bkyle over 9 years ago in reply to athena

Have you tried sysgen on the Kiwi Syslog server?
Cancel
Vote Up 0 Vote Down

Cancel
0 metz over 9 years ago

I just spent the afternoon troubleshooting the same issue. The answer is stupid simple, it just needs to be documented in Help and Forums.
I would guess this applies to the Free Version only, as there is a 5 device limit, and it appears that those devices have to be explicitly enumerated in "Inputs"
Add the IP address of the sending device to the list titled "Receive messages from the below IP addresses".
Cancel
Vote Up +2 Vote Down

Cancel
0 cvachovecj over 9 years ago in reply to metz

Thanks for the feedback, metz.
I'll make sure the 5-device limit of the free version is better communicated.
Regards,
Jiri
Cancel
Vote Up 0 Vote Down

Cancel
0 bvista over 7 years ago in reply to metz

I hate to resurrect a 2 year old post, but thanks Metz for pointing this out. I had the same issue and this fixed it.
Cancel
Vote Up 0 Vote Down

Cancel