Kiwi Syslog not receiving any message

October 2, 2014, 5:44 am

≫ Next: Kiwi - Palo Alto User ID agent

≪ Previous: How to Resolve IP Addresses into Hostnames in Kiwi Syslog Server

$

0

0

Hello,

 

I just installed Syslog on a Windows 8 VM (ESXi 5.5).

However... I don't received any message from the router (Cisco RV042G) I want to log.

 

I tried the generic troubleshhoting :

• Check network connectivity by pinging from the sending device to the Syslog Server machine  => OK
• Check only one instance of Kiwi Syslog Server is running (Ctrl-Shift-Esc to get the task-list) => OK, only one
• Disable any personal firewall software such as ZoneAlarm or BlackIce => Disabled

• Use a sniffer to check if messages from the routing are reaching the PC => Yes, I can see them
• Check DNS resolution is working as expected by pinging a hostname from the Command Prompt => OK
• Check that there is a "Display" action setup for the facility and level you are expecting to receive messages on. => OK
• Send a test message to yourself by pressing Ctrl+T => Displayed
• Download a copy of the Free Syslog Server Message Generator (SyslogGen) from: www.kiwisyslog.com/downloads => Done
• Install SyslogGen and set it to send a message every second to the address 127.0.0.1 (local host). => Not displayed, and I don't see them in a local packet capture.
• Try sending messages with SyslogGen from another machine to the host running the Syslog Server => Not displayed, but see them on a packet capture (on Syslog PC)

 

Do you have any idea about the cause of this issue ?

 

Thanks in advance for your help.

---

Kiwi - Palo Alto User ID agent

January 30, 2013, 1:33 pm

≫ Next: Kiwi Syslog Web Access Accounts

≪ Previous: Kiwi Syslog not receiving any message

$

0

0

I have written a perl script to take data from Kiwi, parse out some information and pass it into our Palo Alto UserID agent.  It runs fine when I pass the message in on the command line but when I have kiwi run it (so to pull the data from kiwi) it fails with an error:

 

Error Info: invalid charater on line 1

 

My script looks like this:

 

sub Main() {

  use PAN::API;

  $string = Fields.VarCleanMessageText;

  $SERVER = '127.0.0.1';

 

  #Extract user and IP from string

  if ($string =~ /(\w+)([.+]|(\s))(\w+)(\s|\+|.)(\d+\.\d+\.\d+\.\d+)/) {

       $delim = ($3 eq "+") ? " " : $3;

       $username = "$1\\$2$delim$5";

       $ip_address = $7;

  }

  print "$username : $ip_address \n";

 

  # Create User ID API connection

  $uid=PAN::API::UID->new($SERVER);

 

  #Post data to agent

  $uid->add('login',$name,$address);

  $uid->submit();

 

  return "OK"; #return value for Kiwi

}

 

Thanks for any guidance.

 

Kevin

Kiwi Syslog Web Access Accounts

October 23, 2014, 9:40 am

≫ Next: Kiwi syslog - how to export syslog Defense Center 3500 to kiwi syslog server

≪ Previous: Kiwi - Palo Alto User ID agent

$

0

0

I understand I can create a maximum of five user accounts for web access. Does this limitation apply to the number of accounts that can access the web interface through AD, too? I have AD authentication set up and I noticed Kiwi automatically creates a local account with the domain\username when a user logs in. Thanks.

 

Jason

Kiwi syslog - how to export syslog Defense Center 3500 to kiwi syslog server

December 11, 2014, 10:52 pm

≫ Next: SNMP Traps

≪ Previous: Kiwi Syslog Web Access Accounts

$

0

0

Hi,

I'm looking for a guide/documentation for exporting syslog from Sourcefire DC 3500 to kiwi syslog server. This is my first time using kiwi syslog  server. I'm requesting guidance from all of you because I would like to see how this product working.

SNMP Traps

December 17, 2014, 11:27 am

≫ Next: Kiwi Syslog not capturing syslogs

≪ Previous: Kiwi syslog - how to export syslog Defense Center 3500 to kiwi syslog server

$

0

0

My Kiwi syslog server will only receive snmp traps if I have both 'SNMP Traps' and 'UDP syslog' inputs selected.  When the messages are received, they are not being translated which makes me think they are not going through the 'SNMP Trap' input and only being processed by the UDP input.  The MIB database has the correct MIBs loaded for the messages being sent.

 

I have no filters running on the rule and the network device is configured correctly.  What am I missing?

Kiwi Syslog not capturing syslogs

May 14, 2013, 1:40 pm

≫ Next: Kiwi Syslog WebAccess Installation Error (error code is 2869)

≪ Previous: SNMP Traps

$

0

0

Installed Kiwi Syslog Free version 9.3.4 on Windows Server 2008 R2.  Trying to capture syslog from a Cisco ASA 5510.  I have confirmed that the syslog events are hitting the server with Wireshark.  Nothing is coming through to Kiwi Syslog.  Current settings are all default.  No filters in place.  Not sure what is wrong as I can see the syslog messages coming through Wireshark. Any ideas as to why the syslog messages are not being seen by Kiwi?

Kiwi Syslog WebAccess Installation Error (error code is 2869)

October 27, 2010, 8:29 pm

≫ Next: Kiwi syslog - 2011-03-18 10:54:01Licensed action was found in settings and disabled.

≪ Previous: Kiwi Syslog not capturing syslogs

$

0

0

*Kiwi Syslog Server V.9.1.0
*Windows 2008 SP1 and SP2 64bit

Our client encountered a Kiwi Syslog WebAccess installation error.

The error message is as follows:
=============================================
The installer has encountered an unexpected error
installing this package. This may indicate a problem
with this package.The error code is 2869.
=============================================
*Kiwi Syslog Server service runs correctly.

*The client stopped Anti-Virus service before the installation.

 

Are there some information to resolve the problem?

Kiwi syslog - 2011-03-18 10:54:01Licensed action was found in settings and disabled.

March 18, 2011, 4:43 am

≫ Next: Kiwi Syslog Server service starts then stops

≪ Previous: Kiwi Syslog WebAccess Installation Error (error code is 2869)

$

0

0

Kiwi syslog stopped collecting information. The view error log button is red and blinking. When i click to view the log

is see  the below message repeating itself:

 

 

2011-03-18 10:54:01     Licensed action was found in settings and disabled.

2011-03-18 10:54:01     Licensed action was found in settings and disabled.

2011-03-18 13:37:56     Licensed action was found in settings and disabled.

2011-03-18 13:37:57     Licensed action was found in settings and disabled.

2011-03-18 13:37:57     Licensed action was found in settings and disabled.

---

Kiwi Syslog Server service starts then stops

August 29, 2011, 2:29 pm

≫ Next: Kiwi Syslog server setup (installation) via SSCM [System Center Configuration Manager] (Windows)

≪ Previous: Kiwi syslog - 2011-03-18 10:54:01Licensed action was found in settings and disabled.

$

0

0

When attempting to start the Kiwi Syslog Server service (on Windows 2008 R2), I get the message "The Kiwi Syslog Server service on [my server name] started and then stopped.  Some services stop automatically if they are not in use by other services or programs."  Any ideas what could be causing this?

Kiwi Syslog server setup (installation) via SSCM [System Center Configuration Manager] (Windows)

March 14, 2014, 10:20 am

≫ Next: Kiwi SysLog Web Access Not Working after Upgradeing WhatsUpGold

≪ Previous: Kiwi Syslog Server service starts then stops

$

0

0

Dear All,

 

I have purchased a Kiwi Syslog Server Ver 9.4.1 and I require to install it onto 60 Servers in my environment. My query is that is there any way to install it using SSCM(System Center Configuration Manager) in Windows? Also I have few conditions in the installation process, these are:

   ------------------------------------------------------------------------------------------------------

     1. As a Service

     2. No Web Access (unchecking it - as it is enabled by default in the wizard)

     3. Local System Account

     4. Normal Install

   ------------------------------------------------------------------------------------------------------

Kindly help me in installing the Kiwi Syslog server.

 

Thanks in Advance.

Kiwi SysLog Web Access Not Working after Upgradeing WhatsUpGold

May 19, 2014, 2:33 pm

≫ Next: How to Split Logs to Multiple Displays in Kiwi Syslog Server

≪ Previous: Kiwi Syslog server setup (installation) via SSCM [System Center Configuration Manager] (Windows)

$

0

0

Both applications have been running on the same server for several years. This is a Windows 2008 R2 64 bit machine, running the Army AGM.

 

WuG is now working 16.x

 

One of the things IPSwitch had me try to do, to fix WuG was install SQL Server Express 2008 R2

 

Kiwi Syslog (KSL) is version 9.3.4, the Kiwi Syslog Server Console "Is" working, only Web Access is down.

 

I tried to reinstall KSL, it worked, but somehow then WuG web access went down, I had to repair IIS and .NET

 

WuG uses 443, trying to get KSL to use 8088 (previously used) or 8888

 

When I try to access (even just Browse Web Site from IIS) I get:

 

"Error An unknown error occurred requesting resource /

Click here to log in"

 

When I click the link:

 

"Error An unknown error occurred requesting resource

/Gateway.aspx

 

Click here to log in"

 

At this point it just loops.

 

In IIS, I deleted the original website and created a new one.  Path I used is:

C:\Program Files (x86)\SolarWinds\Kiwi Syslog Web Access\html

How to Split Logs to Multiple Displays in Kiwi Syslog Server

May 31, 2013, 8:56 am

≫ Next: KIWI EMail Alerts

≪ Previous: Kiwi SysLog Web Access Not Working after Upgradeing WhatsUpGold

$

0

0

SolarWinds's own Justin Finley just recorded a video tutorial that shows how to split logs into multiple displays in Kiwi Syslog Server.

 

External link to Jing: Multiple Displays - justinfinley's library

 

Video Guide:

• 0:00 Unfiltered display (Display 00)
• 0:10 Showing the rule that sends all messages to Display 00
• 0:20 Changing the unfiltered display from Display 00 to Display 05
• 0:25 Checking that the switch happened
• 0:35 Adding a new filter rule looking for the word "logon" and sending it to Display 01
• 1:20 Adding a new filter rule looking for the word "logoff" and sending it to Display 02
• 2:05 Checking that the new filters work
• 2:25 Renaming "Display 05" to "All Messages"
• 2:45 Renaming "Display 01" to "Logon" and "Display 02" to "Logoff"
• 3:10 Checking that the display renaming worked

 

Remember to "LIKE" this if you find it useful - that helps other find it too!

KIWI EMail Alerts

January 16, 2014, 6:13 am

≫ Next: Kiwi Syslog not displaying Cisco ASA 5505 syslogs

≪ Previous: How to Split Logs to Multiple Displays in Kiwi Syslog Server

$

0

0

Hello,

 

I have been working with Kiwi and trying to setup custom email alerts for a number of devices and have ran into an issue and wondering if anyone has any insight for me.

 

For Example if I setup the following email alerting Rule Set:

 

Critical Devices

     + Filters

          + IP Range = 192.168.0.1 - 192.168.0.55

          + Priority = All Facilities (Emerg + Alert)
          + Flags/Counters = Time Interval (60 Minutes)

     + Actions

          + E-Mail Message (MyEmail@email.com)

 

 

So with the above example I am just looking to get alerts for my critical devices, in this example they are all in the sub-net above, and the time interval is set to ensure that I am not getting bombarded with a ton of alerts in a short period of time.

 

The issue:

If I have two different devices that are triggering critical events at the same point in time, I will only get alerts from one of those devices based on the rule set above.

 

The Question:

Is there a way to configure ONE rule set to alert on a series of devices, and the flags and counters will only come into effect if its the SAME device sending the critical message within the time frame specified? Without creating a separate rule set for each critical device?

 

My Thoughts:

My Assumption is no this is not possible without creating different rule sets. If this is the case, I was thinking maybe the only way to accomplish what I want is VIA a script, my only issue would be is that if I create a script, I am unsure what command I would use to get Kiwi to stop processing the actions.

 

Ex. If critical alert comes in

          check if alert has been processed in last 60 minutes

               if yes

                    Exit

               else

                    Send alert

              end if

     end if

 

Obviously that is very basic, but perhaps it can get the idea across. My issue is that I have no idea what I can do VIA script to tell Kiwi to stop processing actions after my script if my script determines the alerts have been sent in the last 60 minutes.

 

 

Sorry if this is confusing, please let me know if I should clarify anything.

 

Jamie

Kiwi Syslog not displaying Cisco ASA 5505 syslogs

April 2, 2011, 7:21 pm

≫ Next: I can't install Kiwi Syslog Web Access

≪ Previous: KIWI EMail Alerts

$

0

0

I have a Cisco ASA 5505 that is setup to send syslogs to a remote syslog server.

I have kiwi syslog (free) installed on a Windows 2003 R2 Server and it is listening on UDP port 514. The syslog server also is my Ciscoworks v3.2 server.

I can ONLY see the Ciscoworks log files and not the ASA. I only want to display the ASA log files.

I have googled, read the user guide, and search the forum and cannot find any procedure that I can tweak Kiwi to log the syslog files from my ASA which is being used as a VPN concentrator.

Any ideas?

I can't install Kiwi Syslog Web Access

July 21, 2010, 4:56 pm

≫ Next: How to Split Log Files by IP Address and Date in Kiwi Syslog Server

≪ Previous: Kiwi Syslog not displaying Cisco ASA 5505 syslogs

$

0

0

Hi all,

I can't install Kiwi Syslog Web Access. Syslog server is installing fine but Web Access is just says that there is an error and rolls back. I had evaluated version installed before and now trying to install licensed.

---

How to Split Log Files by IP Address and Date in Kiwi Syslog Server

May 31, 2013, 9:19 am

≫ Next: Can not receive message from Cisco switch 3750

≪ Previous: I can't install Kiwi Syslog Web Access

$

0

0

SolarWinds's own Justin Finley just recorded a video tutorial that shows how to split logs into multiple files by IP address and date in Kiwi Syslog Server.  Specifically, this syslog server tutorial shows how to store logs in separate folders for each source IP address, and then shows how to keep separate log files for each day within those folders.  (e.g., "D:\logs\192.168.000.001\Log2012-07-13.txt")

 

 

External link to Jing: autosplit - justinfinley's library

 

Video Guide:

• 0:00 Opening Kiwi Syslog's configuration dialog
• 0:15 Using an "AutoSplit" variable of "IP Address (4 octets)" (%IPAdd4) in the log path to split logs by IP address
• 0:40 Using an "AutoSplit" variable of "ISO Date" (%DateISO) in the log path to split logs by date

 

Remember to "LIKE" this if you find it useful - that helps other find it too!

Can not receive message from Cisco switch 3750

July 28, 2013, 11:37 pm

≫ Next: Kiwi Syslog Server Setup Window is Blank

≪ Previous: How to Split Log Files by IP Address and Date in Kiwi Syslog Server

$

0

0

Hello guys,

 

I setup kiwi syslog server and could receive message from other devices, such cisco switch 2960, 5510, and windows server. But can not get any message from 3750. I enclosed 3750 configuration as below. Please help to take a look and where am I wrong. Thank you.

 

logging trap notifications

logging facility local5

logging 192.168.0.51

Kiwi Syslog Server Setup Window is Blank

June 6, 2014, 1:47 pm

≫ Next: Kiwi syslog 9.4 on windows server 2012 64bit Service crash - Possible bug!

≪ Previous: Can not receive message from Cisco switch 3750

$

0

0

The program was originally setup before I started working here. Recently I was asked to have some data emailed to the IT here, well I opened up the interface, and the Kiwi Syslog Server Setup window is blank, except for the menu items at the top and the buttons at the bottom right.

After some searching around on google, I figured out that the interface was missing a lot of stuff.

 

Besides the setup interface being blank, the server functions and is performing email tasks that were previously setup.

 

Any suggestions on resolving this issue?

 

Kiwi Syslog Server V9.2 licensed, maintenance has expired

Windows 7 Pro 64 Bit

Kiwi syslog 9.4 on windows server 2012 64bit Service crash - Possible bug!

October 2, 2013, 4:10 am

≫ Next: Kiwi Syslog not capturing syslogs

≪ Previous: Kiwi Syslog Server Setup Window is Blank

$

0

0

Hello , kiwi friends!

 

I am trying to get Kiwi syslog 9.4 to work on windows server 2012 64bit but having problems with the service crashing then i try to start the kiwi syslog server console.

I have applied the kb fix for Microsoft .Net Framework 2 , before that i couldnt install kiwi syslog successfully becuse the service could not start.

http://knowledgebase.solarwinds.com/kb/questions/4386/

 

 

I have the following errors in the windows event viewer!

Error 7000: The Kiwi Syslog Server service failed to start due to the following error:
The service did not respond to the start or control request in a timely fashion

Error 7009 : A timeout was reached (30000 milliseconds) while waiting for the Kiwi Syslog Server service to connect.

 

Do you have a solution for this or could it be a new bug in windows server 2012 and the old dot net framework combined ?

 

Thanks in advance.

Kiwi Syslog not capturing syslogs

May 14, 2013, 1:40 pm

≫ Next: How to load-balance Kiwi Syslog servers

≪ Previous: Kiwi syslog 9.4 on windows server 2012 64bit Service crash - Possible bug!

$

0

0

Installed Kiwi Syslog Free version 9.3.4 on Windows Server 2008 R2.  Trying to capture syslog from a Cisco ASA 5510.  I have confirmed that the syslog events are hitting the server with Wireshark.  Nothing is coming through to Kiwi Syslog.  Current settings are all default.  No filters in place.  Not sure what is wrong as I can see the syslog messages coming through Wireshark. Any ideas as to why the syslog messages are not being seen by Kiwi?