This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.

You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

Adding a Syslog node

omarahmed over 9 years ago

I am running a practice VM of Solarwinds LEM at home. I have a dlink router which used to send logs(web access) via syslog to kiwi syslog server. At about 1500 logs per hour.

I changed the dlink router to send syslog to the LEM vm ip ( 192.168.0.100).

I then went to Manage>Nodes>Add a new node > Syslog node and filled in the ip address of the dlink router (192.168.0.1). I then check the I have configured.... option and clicked finish. I got a message "LEM has not found any new nodes or connectors in the syslog files that are being monitored".

When i switch the dlink to send syslog to the kiwi syslog ip, I see syslog mesages.

I have no idea what to do.

Please assist

Top Replies

HolyGuacamole over 9 years ago in reply to omarahmed +2

It doesn't look like there is a connector readily available for this device. However, new connectors are added fairly regularly and if this device supports Syslog, it would be relatively easy to add a…

0 HolyGuacamole over 9 years ago

see the evaluation guide in the documentation section of the website. For the action you describe to work, there must be
a) enough log messages for the discovery to determine the correct device type
b) LEM must have a connector to handle these logs
the eval guide walks you through how to check for the messages and the connectors.
Cancel
Vote Up 0 Vote Down

Cancel
0 yeah_yeah over 9 years ago

Having a similar issue. On Kiwi, see lots of log activity. In LEM, barely see any action.
Cancel
Vote Up 0 Vote Down

Cancel
0 HolyGuacamole over 9 years ago in reply to yeah_yeah

What you see in LEM by default is normalized events, not raw syslog messages like Kiwi. Unless the relevant connectors are turned on, there will be no normalization and hence no activity in LEM. Please see the section on Connectors in
http://www.solarwinds.com/documentation/LEM/Docs/LEM_Evaluation_Guide.pdf
Cancel
Vote Up 0 Vote Down

Cancel
0 omarahmed over 9 years ago in reply to HolyGuacamole

Hi
Thank you for the relatively quick response. Are dlink home routers supported ? most small offices use these kind of routers for internet e.g (DIR 645 etc.)
Cancel
Vote Up 0 Vote Down

Cancel
0 HolyGuacamole over 9 years ago in reply to omarahmed

It doesn't look like there is a connector readily available for this device. However, new connectors are added fairly regularly and if this device supports Syslog, it would be relatively easy to add a new connector. I suggest you open a ticket Technical Support Ticket Submission Form | SolarWinds and submit a log sample to evaluate this further.
Cancel
Vote Up +2 Vote Down

Cancel
0 omarahmed over 9 years ago in reply to HolyGuacamole

I basically just get syslog logs of all web traffic going through the router. I just want to be able to do analysis against the logs to determine all traffic going to sites matching %S__E__%torrent% '
Basically I'm trying to practice a situation where I am expected to catch guys downloading tv series.
Assuming no security device can be placed inline due to logical and budgetary restraints.
Cancel
Vote Up 0 Vote Down

Cancel
0 HolyGuacamole over 9 years ago in reply to omarahmed

Have you tried setting an Action in Kiwi Syslog Server? It should do the job here.
Cancel
Vote Up 0 Vote Down

Cancel
0 omarahmed over 9 years ago in reply to HolyGuacamole

How would I go about this? I'm pretty new to Kiwi and syslog in whole
Cancel
Vote Up 0 Vote Down

Cancel
0 HolyGuacamole over 9 years ago in reply to omarahmed

Install Kiwi, launch the console, click help and search for actions in the documentation
Cancel
Vote Up 0 Vote Down

Cancel