This is probably me being silly.
I have defined a cloud MS loopback from GNS3 emulated router. Wireshark can see the packet. If I replace Kiwi with a quick VB programme it can see the record but I can not get Kiwi to display the record.
Regards Conwyn
Waiting for broadcast
Received broadcast from 10.10.10.1:65347 :
0j☻☺ ♦♠public?]♠ +♠☺♦☺ +☻@♦
☺☻☺♠☻☺☺C♥6"[0?0‼♠♫+♠☺♦☺ +☺☺♠☺♥‼☻☺☺0‼♠♫+♠☺♦☺ +☺☺♠☺♦‼☻☺☻0‼♠♫+♠
☺♦☺ +☺☺♠☺♣‼☻☺♥
Waiting for broadcast
Here is Kiwi
Hello,
I just installed Syslog on a Windows 8 VM (ESXi 5.5).
However... I don't received any message from the router (Cisco RV042G) I want to log.
I tried the generic troubleshhoting :
• Check network connectivity by pinging from the sending device to the Syslog Server machine => OK
• Check only one instance of Kiwi Syslog Server is running (Ctrl-Shift-Esc to get the task-list) => OK, only one
• Disable any personal firewall software such as ZoneAlarm or BlackIce => Disabled
• Use a sniffer to check if messages from the routing are reaching the PC => Yes, I can see them
• Check DNS resolution is working as expected by pinging a hostname from the Command Prompt => OK
• Check that there is a "Display" action setup for the facility and level you are expecting to receive messages on. => OK
• Send a test message to yourself by pressing Ctrl+T => Displayed
• Download a copy of the Free Syslog Server Message Generator (SyslogGen) from: www.kiwisyslog.com/downloads => Done
• Install SyslogGen and set it to send a message every second to the address 127.0.0.1 (local host). => Not displayed, and I don't see them in a local packet capture.
• Try sending messages with SyslogGen from another machine to the host running the Syslog Server => Not displayed, but see them on a packet capture (on Syslog PC)
Do you have any idea about the cause of this issue ?
Thanks in advance for your help.
Is there no way to create a custom Event log and log items to it? Can you not change the event IDs of any of your rules? Can you at least parse any of the syslog message to the event in order to change the hostname its coming from or source? can you not modify the message as it is logged maybe to strip out the date and time (In order to set consolidation of alerting in other programs you are catching these alerts)? All I am able to do is change the message type (Event Level).
This is a HUGE win for us if ANY of these ideas can be added.
Currently we are sending SAN array alerts through syslog and catching it through Kiwi. Kiwi is logging to the event log and SCOM is picking it up and notifying the correct party. However, there is not much we can do at the moment in Kiwi to have the event logged in a way to use several different actions in SCOM since your choices are only Warning, Error, or informational.
Please let me know if you are having any of these same problems or if you know another way around this. There are free syslog servers that aren't nearly as good as syslog for filtering and rules, but you have the options to send alerts to several different custom Event logs.
I've got a set of 3 Kiwi servers sitting behind an F5, which I *thought* would effectively load balance the incoming syslog volume (I'm seeing around 5-8million messages per hour, and we haven't really turned everything on yet).
The problem, I just discovered, is that F5 load balances based on connections, not messages/packets. So round robin isn't round robin since most of my sending systems are passing new messages (and therefore creating a connection) more than even the lowest "disconnect after" option on the F5 (which is 1 second).
So my first server is maxing out at about 5million MPH and 0% buffer, while server 02 gets 2million messages and 80% buffer, and server 03 gets barely anything at all.
Has anyone else tried this, and have you found a work around (it doesn't have to be an F5. I just need the ability to create a pool of Kiwi servers and have all the systems in my enterprise sending to ONE ip address.
Thanks!
- Leon
Hi,
When trying to start the Kiwi Syslog Server we are receiving the following error: Error 1053: The service did not respond to the start or control reqest in a timely fashion.
We also get the following messages in Event Viewer:
A timeout was reached (30000 milliseconds) while waiting for the Kiwi Syslog Server service to connect.
We are using the free version and had it running quite happily for 2 months before this issue occured. I can't find what may have changed on the day it started to fail. The tool is running on a Win7 Enterprise machine. I have tried the changes suggested here: http://knowledgebase.solarwinds.com/kb/questions/4386/Kiwi+Syslog+Server+Service+Startup+Failure+in+Versions+9.3.3+and+9.3.4 but they didn't work. I have also read the following but the service for me doesn't start no matter what account is used: http://thwack.solarwinds.com/thread/45470
Any suggestions would be greatly appreciated!
Hi all,
I am currently using kiwi syslog 9.1 in win2008 which i have been using for a few months.
Since yesterday i can see that for every minute a file name "192.168.x.x-515-connectionxxxx.bin" is generated under C:\program files (x86)\syslogd \cache
Each file has a size of 1MB.
I tried deleting the cache folder but after sometime this file generation thing comes back again.
Pls advise how this can be solved? Thks in advance.
Hi,
I have a Windows NPS server, and I need to be able to forward the logs to a syslog server. Would Solarwinds log forwarder be able to do this?
Thank you
I'm currently using linux (as network device) and manually generated syslog messages for testing SolarWinds syslog messages.
I'm receiving syslog messages normally (there is some text in message field) but there is no information in sysname, community, tag, vendor etc...I'm aware that SolarWinds uses RFC 3164 format for syslog messages, but I don't know how to add those few fields in the same syslog message.
How SolarWinds does pick up those from the syslog message? How to add vendor, community etc to there..
Thanks..
We recently set up a Windows RRAS server for vendor VPN access. How do we gather VPN connection data into Kiwi syslog server?
My question is - in creating a Kiwi (v9.0.3) Syslog Web Access filter to filter on a certain string within the Syslog message text, is there a wildcard character that I can use? Thanks for any help! bp
Hello,
I have an issue with the migration of my kiwi syslog product.
I have got a new server and I want to migrate my kiwi syslog version on this new server (after deactivating it on the old one).
When I read the documentation it is said to install the licence manager tool.
But when I use it, the tool says "No licensed solarwinds products on your machine".
But my two products are well registered and I can see the licenses on my online account.
Is it possible to deactivate them manually ?
Thanks for your helpsyslog
Hello,
I just installed Syslog on a Windows 8 VM (ESXi 5.5).
However... I don't received any message from the router (Cisco RV042G) I want to log.
I tried the generic troubleshhoting :
• Check network connectivity by pinging from the sending device to the Syslog Server machine => OK
• Check only one instance of Kiwi Syslog Server is running (Ctrl-Shift-Esc to get the task-list) => OK, only one
• Disable any personal firewall software such as ZoneAlarm or BlackIce => Disabled
• Use a sniffer to check if messages from the routing are reaching the PC => Yes, I can see them
• Check DNS resolution is working as expected by pinging a hostname from the Command Prompt => OK
• Check that there is a "Display" action setup for the facility and level you are expecting to receive messages on. => OK
• Send a test message to yourself by pressing Ctrl+T => Displayed
• Download a copy of the Free Syslog Server Message Generator (SyslogGen) from: www.kiwisyslog.com/downloads => Done
• Install SyslogGen and set it to send a message every second to the address 127.0.0.1 (local host). => Not displayed, and I don't see them in a local packet capture.
• Try sending messages with SyslogGen from another machine to the host running the Syslog Server => Not displayed, but see them on a packet capture (on Syslog PC)
Do you have any idea about the cause of this issue ?
Thanks in advance for your help.
I have written a perl script to take data from Kiwi, parse out some information and pass it into our Palo Alto UserID agent. It runs fine when I pass the message in on the command line but when I have kiwi run it (so to pull the data from kiwi) it fails with an error:
Error Info: invalid charater on line 1
My script looks like this:
sub Main() {
use PAN::API;
$string = Fields.VarCleanMessageText;
$SERVER = '127.0.0.1';
#Extract user and IP from string
if ($string =~ /(\w+)([.+]|(\s))(\w+)(\s|\+|.)(\d+\.\d+\.\d+\.\d+)/) {
$delim = ($3 eq "+") ? " " : $3;
$username = "$1\\$2$delim$5";
$ip_address = $7;
}
print "$username : $ip_address \n";
# Create User ID API connection
$uid=PAN::API::UID->new($SERVER);
#Post data to agent
$uid->add('login',$name,$address);
$uid->submit();
return "OK"; #return value for Kiwi
}
Thanks for any guidance.
Kevin
Hi all,
New here, searched for discussions but found no entry on procurve switch(es).
The Procurve switches will not send any syslog messages (wiresharked the server)
Turned on logging on the switch: logging 'ip-address'
show debug
Debug Logging
Source IP Selection: Outgoing Interface
Destination:
Logging --
'ip-address' Kiwi Syslog server
Protocol = UDP
Port = 514
Facility = user
Severity = info
System Module = all-pass
Priority Desc =
tried facility 'syslog' still nothing.
Only the Procurve switches will not send any syslog messages.
Other devices such as Cisco ASA's work fine.
Anyone ideas to solve this?
TIA Jaap
What it does:
Log Forwarder for Windows allows you to forward Windows events as Syslog to your Kiwi Syslog Server
How to get it:
If you download the Kiwi Syslog Server 9.0 from your customer portal, you will see there is an additional Log Forwarder executable included with your download. The Log Forwarder for Windows was developed by the Kiwi Syslog team. It is available at no cost to Kiwi Syslog customers current on maintenance.
Try it out and let us know what you think!
This is probably me being silly.
I have defined a cloud MS loopback from GNS3 emulated router. Wireshark can see the packet. If I replace Kiwi with a quick VB programme it can see the record but I can not get Kiwi to display the record.
Regards Conwyn
Waiting for broadcast
Received broadcast from 10.10.10.1:65347 :
0j☻☺ ♦♠public?]♠ +♠☺♦☺ +☻@♦
☺☻☺♠☻☺☺C♥6"[0?0‼♠♫+♠☺♦☺ +☺☺♠☺♥‼☻☺☺0‼♠♫+♠☺♦☺ +☺☺♠☺♦‼☻☺☻0‼♠♫+♠
☺♦☺ +☺☺♠☺♣‼☻☺♥
Waiting for broadcast
Here is Kiwi
If I setup Kiwi Syslog to forward to another system such a Voyence. Will Kiwi keep the source IP of the deivce that sent the syslog?
On faster Windows 7 machines it has been reported that the Kiwi SyslogGen (Syslog Message Generator) test utility sometimes does not actually send messages to a locally installed Kiwi Syslog Server. If SyslogGen does not send messages to your syslog server through localhost, please try the following suggestions in your Kiwi Syslog Message Generator configuration.
You can download a free copy of Kiwi SyslogGen from the Kiwi Downloads page.
I successfully installed Kiwi Syslog server (latest version) and successfully received 18.8 million logs in 5 – 6 hours and after that the application crashes and every time I re-start the service it keeps crashing. I too would like to know if this issue has been resolvable? and if so how was it done. We are required to log these messages because of audit regulations and we have multiple firewalls logging to this one server. If Kiwi cannot keep up kindly let us know or suggest any other option.
following are the system events:
Faulting application name: Syslogd_Service.exe, version: 9.4.0.1, time stamp: 0x5256d794
Faulting module name: ntdll.dll, version: 6.1.7601.18247, time stamp: 0x521ea8e7
Exception code: 0xc0000005
Fault offset: 0x000552a2
Faulting process id: 0x49c
Faulting application start time: 0x01cfedd553cc3c0b
Faulting application path: C:\Program Files (x86)\Syslogd\Syslogd_Service.exe
Faulting module path: C:\Windows\SysWOW64\ntdll.dll
Report Id: 98b25655-59c8-11e4-8349-005056bb1e35
Fault bucket , type 0
Event Name: APPCRASH
Response: Not available
Cab Id: 0
Problem signature:
P1: Syslogd_Service.exe
P2: 9.4.0.1
P3: 5256d794
P4: ntdll.dll
P5: 6.1.7601.18247
P6: 521ea8e7
P7: c0000005
P8: 000552a2
P9:
P10:
Attached files:
These files may be available here:
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Syslogd_Service._dae90f6dff5377cb3818b3577cc016b8e269a5_1190477d
Analysis symbol:
Rechecking for solution: 0
Report Id: 98b25655-59c8-11e4-8349-005056bb1e35
Fault bucket , type 0
Event Name: APPCRASH
Response: Not available
Cab Id: 0
Problem signature:
P1: Syslogd_Service.exe
P2: 9.4.0.1
P3: 5256d794
P4: ntdll.dll
P5: 6.1.7601.18247
P6: 521ea8e7
P7: c0000005
P8: 000552a2
P9:
P10:
Attached files:
These files may be available here:
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Syslogd_Service._dae90f6dff5377cb3818b3577cc016b8e269a5_1190477d
Analysis symbol:
Rechecking for solution: 0
Report Id: 98b25655-59c8-11e4-8349-005056bb1e35
Report Status: 0
Hello , kiwi friends!
I am trying to get Kiwi syslog 9.4 to work on windows server 2012 64bit but having problems with the service crashing then i try to start the kiwi syslog server console.
I have applied the kb fix for Microsoft .Net Framework 2 , before that i couldnt install kiwi syslog successfully becuse the service could not start.
http://knowledgebase.solarwinds.com/kb/questions/4386/
I have the following errors in the windows event viewer!
Error 7000: The Kiwi Syslog Server service failed to start due to the following error:
The service did not respond to the start or control request in a timely fashion
Error 7009 : A timeout was reached (30000 milliseconds) while waiting for the Kiwi Syslog Server service to connect.
Do you have a solution for this or could it be a new bug in windows server 2012 and the old dot net framework combined ?
Thanks in advance.