Hi guys,

I'm trying to achieve the following

I created a rule with its first filter matching All levels, followed by another rule matching devices starting "^abc" and then, what I'm trying to do is to filter ASA syslog messages with regex like this

Filter name: Include ASA Failover msg

Filter Field Message Text - Filter Type RegExp

"^%ASA-[0-7]-10(1|4)" "^%ASA-[0-7]-210" "^%ASA-[0-7]-311" "^%ASA-[0-7]-709"

Filter name: Include ASA IP Stack msg

Filter Field Message Text - Filter Type RegExp

"^%ASA-[0-7]-209" "^%ASA-[0-7]-215" "^%ASA-[0-7]-313" "^%ASA-[0-7]-317" "^%ASA-[0-7]-408"

And so and so.

Last rule is the one I'm testing on which is matching msgs code more common

Filter name: Test 2

Filter Field Message Text - Filter Type RegExp

"^%ASA-[0-7]-30(5|7)" "^%ASA-[0-7]-10"

Test2 by itself is working fine, but every time I activate any of the previous ones that are above this one, it stops working. Not getting any message on my Display. Btw, the action on this Rule is forward messages to a particular Display.

I realized that a bad regex filter could stop the syslog console from working.

Any thoughts?

EDIT: Is it possible that all the include statements have to be all under the same filter?

Cheers,

I want to encrypt syslog from Cisco swirtch or router into Kiwi Syslog.

I read somewhere I can use syslog tls or snmp trap v3

Is that possible using Kiwi Syslog

thanks

I'm trying to forward events from Kiwi Syslog to QRadar SIEM. 

In Kiwi Syslog setup, I created an Action: Forward to another host; gave it the QRadar appliance's IP as the Destination IP; selected "Retain the original source address of the message"; clicked the Test button to verify the configuration and got a gree checkmark.

The test event was the only event received by the QRadar.  None of the events I'm forwarding have been received as incoming logs on QRadar.

I've tried this with and without adding the Kiwi Syslog servers as log sources in QRadar.

Do I need to install a universal DSM on the Kiwi Syslog servers?

Hi There,

I'm trialing Kiwi Syslog and I'm having trouble with the Log Forwarder and Security Event Log.  When I click on the Security Log I don't see Audit Success or Audit Failure as an event type.  It just has Error, Warning and Information.  If I manually edit the CFG file and add <int>16</int> it works, but then it gets overwritten if I make a change.  Am I doing something wrong?  How can I see Audit Failure as an Event Type?

Thanks,

Hello,

  We are looking to find the Windows file/folder location for where the Kiwi Syslog Web Access is pulling its records from?

  We currently save events to the syslogd/logs location, as well as a SQL database.  But when we setup in the Kiwi Syslog Console Service Manager to send forwarded events to the 'Log to Kiwi Syslog Web Access', we cannot find where it stores those records?

Thanks,

Mark

I've got a set of 3 Kiwi servers sitting behind an F5, which I *thought* would effectively load balance the incoming syslog volume (I'm seeing around 5-8million messages per hour, and we haven't really turned everything on yet).

The problem, I just discovered, is that F5 load balances based on connections, not messages/packets. So round robin isn't round robin since most of my sending systems are passing new messages (and therefore creating a connection) more than even the lowest "disconnect after" option on the F5 (which is 1 second).

So my first server is maxing out at about 5million MPH and 0% buffer, while server 02 gets 2million messages and 80% buffer, and server 03 gets barely anything at all.

Has anyone else tried this, and have you found a work around (it doesn't have to be an F5. I just need the ability to create a pool of Kiwi servers and have all the systems in my enterprise sending to ONE ip address.

Thanks!

- Leon

Hello,

I just installed Syslog on a Windows 8 VM (ESXi 5.5).

However... I don't received any message from the router (Cisco RV042G) I want to log.

I tried the generic troubleshhoting :

• Check network connectivity by pinging from the sending device to the Syslog Server machine  => OK
• Check only one instance of Kiwi Syslog Server is running (Ctrl-Shift-Esc to get the task-list) => OK, only one
• Disable any personal firewall software such as ZoneAlarm or BlackIce => Disabled

• Use a sniffer to check if messages from the routing are reaching the PC => Yes, I can see them
• Check DNS resolution is working as expected by pinging a hostname from the Command Prompt => OK
• Check that there is a "Display" action setup for the facility and level you are expecting to receive messages on. => OK
• Send a test message to yourself by pressing Ctrl+T => Displayed
• Download a copy of the Free Syslog Server Message Generator (SyslogGen) from: www.kiwisyslog.com/downloads => Done
• Install SyslogGen and set it to send a message every second to the address 127.0.0.1 (local host). => Not displayed, and I don't see them in a local packet capture.
• Try sending messages with SyslogGen from another machine to the host running the Syslog Server => Not displayed, but see them on a packet capture (on Syslog PC)

Do you have any idea about the cause of this issue ?

Thanks in advance for your help.

according to the FAQ.. Our software is built and tested to support more than two million messages an hour without tuning.   (That would support more than 500 machines each sending one message a second.)

Hi all,

I am currently using kiwi syslog 9.1 in win2008 which i have been using for a few months.

Since yesterday i can see that for every minute a file name "192.168.x.x-515-connectionxxxx.bin" is generated under C:\program files (x86)\syslogd \cache

Each file has a size of 1MB.

I tried deleting the cache folder but after sometime this file generation thing comes back again.

Pls advise how this can be solved? Thks in advance.

Is there any way for me to export Kiwi Syslogs.  I want to be able to export the syslogs from a licensed Kiwi server into another database for viewing.  Specifically the NPM database.  I would think that there would have been something to do this already since both are SolarWinds products, but I am unable to find it.
  I want to be able to take the logs off the Kiwi server and view them elsewhere, without viewing through Kiwi.  I want to view them through NPM, but I guess I can get by viewing them through something like Access.  Is there a way (even if it isn't easy) to do this?

After upgrade, when I start the Kiwi Syslog app I get a box that comes up and says "Trial version of ActiveSkin control" and I need to click OK.  Anyone else see this?

Debbi

HI all,

My first post, i wish to share you some tips i found.

My main goal was to have access to the kiwi web site working with SSL...

But looking at Cassinni Web Server, it wasn't possible.

After searching more on this forum I found a post about a Rewriting Module with Apache ; so why dont we do it with IIS ?

Here we go !

Setup

- Win 2008 R2 , IIS 7 (with auth modules etc ...) , at least a working SSL certificate for the HTTPS listener (this post will not cover how PKI works, certs installation etc .... sorry).

- We will use the ARR 2.0 module x64 for IIS... See References at bottom for DL link, install it.

- A running Kiwi Syslog Server and the Web Access working on port 8088. Access via a browser works on this port.

Goal

- Enable the rewrite/proxy module in IIS

- Create a new IIS Web Site with HTTPS Listener on TCP Port 8090

- Create a rule to rewrite requests from 8090 to 8088

- When connecting on https://server:8090 , we would see Kiwi Web page.

HOW TO

1. Enabling the rewrite module

"C:\Windows\System32\inetsrv\appcmd.exe" set config  -section:system.webServer/proxy /enabled:"True"  /commit:apphost

2. New Site creation

set syslogwebdir=c:\inetpub\syslog

set syslogsitename=SYSLOG

"C:\Windows\System32\inetsrv\appcmd.exe" add site /name:"%syslogsitename%" /id:15 /bindings:https/*:8090: /physicalPath:"%syslogwebdir%"

3. Attach the SSL Certificate to the Binding 8090

3.1 With batch/cmd line(copy/past to a BAT file)

set CERTHASH=EnterYourHashHere

netsh http add sslcert ipport=0.0.0.0:8090 certhash=%CERTHASH% appid={00000000-0000-0000-0000-000000000000}

3.2 With IIS Manager (if you don't know where to read Hash Certificate).

-Right Click on SYSLOG site, modify Bindings.

-Select https 8090 * Listener > Modify.

-On the "box" SSL Certificate, choose your certificate for the server.

-"OK"

4. Create the rule (copy/past to a BAT file)

set syslogsitename=SYSLOG

set syslogrulename="Rewrite to Kiwi localhost 8088"

:: Rewrite Rule creation
"C:\Windows\System32\inetsrv\appcmd.exe" set config "%syslogsitename%" -section:system.webServer/rewrite/rules /+[name='%syslogrulename%']

:: Rule Parameters (one line)
"C:\Windows\System32\inetsrv\appcmd.exe" set config "%syslogsitename%" -section:system.webServer/rewrite/rules /[name='%syslogrulename%'].action.type:"Rewrite" /[name='%syslogrulename%'].match.url:"(.*)" /[name='%syslogrulename%'].action.url:"http://localhost:8088/{R:1}"

5. End

Test with your browser https://localhost:8090/

Now you can access from an "admin desktop" to this new SSL web site ...

Configure your firewalls to forbid access on port 8088 to this server (or/and configure the internal Windows Firewall of this server to allow only Localhost connection on 8088).

6. Refs Used

http://learn.iis.net/page.aspx/659/reverse-proxy-with-url-rewrite-v2-and-application-request-routing/

http://learn.iis.net/page.aspx/489/using-the-application-request-routing-module/

---

At the beginning i was thinking to use http://mysite/syslog/ as a virtual directory, but I got some troubles with events.aspx and the rewrite module.

Inbound Rules was OK ; But Outbound Rules to rewrite URLS were not working as expected ; and filters in Kiwi were not working anymore.

That's why i decided to create a new site on another binding, with a root site ; so don't need to create Outbound Rules ...

---

Sorry for my English ...  i'm french :)

As you all may recall, it's been 7 months since Kiwi Syslog v9.5 was posted (see Kiwi Syslog 9.5 is now Available! ).  I am very much looking forward to a major release (i.e. v10).  What would this new version contain?  I have a few things in my wish-list...

• Increased the of number of syslog messages and snmp traps that can Kiwi can handle. According to a posting on Geek Speak (How many messages can Kiwi Syslog manage?), Kiwi can handle between 400 and 600 messages per second.  I'd like to see that go all the way up to 2,000 messages (or more).
• Rules Wizard (for the novice and those of us with diminished brain-cells due to age. 
• Full web-based management option.  I don't know about other Thwackers, but I prefer not to use Win32 (via RDP) whenever possible.
• Additional Polling Engine option for Kiwi.  This, so we can have multiple servers handle syslog messages and snmp traps.

I am sure that other Thwackers have many other items in their respective wish-list for Kiwi.  I'd like to hear from you.  And, of course, I'd like to hear from the Kiwi PM, to tell us what's in the Roadmap for the next Kiwi release.  Have a great day, everyone!!! 

Hi people !

I am testing Kiwi Syslog Server Service edition with Evaluation Version....

I am running Kiwi on a 2008r2 SP1 (R2 is x64).

I am trying to run the Kiwi daemon with the system local account ; but i have the error 1053 poping:

"  The service did not respond to the start or control request in a timely fashion "

I tried to adjust the timeout Value in the Registry to 60 (30 by default) ; no way the kiwi syslog Service don't start.

I created the debugging value to see what happening on startup, but i have only :

2011-11-21 18:50:19    Start-up file Initialized.
2011-11-21 18:50:19    Performing NT Service setup for Kiwi Syslog Server
2011-11-21 18:50:19    Service Starting - NTServiceSetup

--

When i am using the administrator account of the server ; the service starts quickly ...here is the debug log :

2011-11-21 19:03:44    Start-up file Initialized.
2011-11-21 19:03:44    Performing NT Service setup for Kiwi Syslog Server
2011-11-21 19:03:44    Service Starting - NTServiceSetup
2011-11-21 19:03:44    Service startup triggered. Parameters:
2011-11-21 19:03:45    Startup entered
2011-11-21 19:03:45    About to initialise sockets
2011-11-21 19:03:45    Listening on InterApp TCP port 3300
2011-11-21 19:03:45    Listening on UDP port 514
2011-11-21 19:03:46    Message check timer started
2011-11-21 19:03:46    Startup completed

But for security reason i can't use an admin Account, i need to use the local system account.

--

I ran procmon to see what's wrong ; no errors about File/Registry denied access.

When using Local system account, the process stops here :

--

When using an Admin account , the process starts, and "hits" an .INI file (KRDP_Sessions.ini) :

--

Can you have any information on this ?

Regards,

Where would I find stored filters on server in the event of copying configurations to another server?

We are a small shop IT department and it has been emphasized to us to monitor our syslogs.  We do not have a lot of background in this.  I have been playing with KIWI but the amout of logs to gather is overwhelming.  We need some guidance or best practices for setting up a log server and what to focus on.  We have firewalls, switches and multiple windows servers.  I can easily gather all the info but knowing what to focus in on is the hard part.  Any guidance would be helpful.  Out of all the documentation I have not found something like this or I dont know what to look for.  Thanks!

Phillip

I have a Cisco ASA 5505 that is setup to send syslogs to a remote syslog server.

I have kiwi syslog (free) installed on a Windows 2003 R2 Server and it is listening on UDP port 514. The syslog server also is my Ciscoworks v3.2 server.

I can ONLY see the Ciscoworks log files and not the ASA. I only want to display the ASA log files.

I have googled, read the user guide, and search the forum and cannot find any procedure that I can tweak Kiwi to log the syslog files from my ASA which is being used as a VPN concentrator.

Any ideas?

After upgrading to v9.5.1, from v9.5.0, we started experiencing constant crashing on our console. Other than a few minor quirks and annoyances, the previous version had not really crashed too often after we applied the hotfix.

Windows Server 2012

Virtual

4 CPUs(2 Cores per Socket, 2 Sockets)

24 GB RAM

150 GB Hard Disk

Kiwi Syslog Server, Installed as a Service

I began to notice the message buffer would quickly drop down from 100%, shortly after starting up the console. Sometimes we would only reach 43K MPH before crashing, while other times we made it up around 350K+ MPH before crashing. And, every time it would crash, the message buffer would be far away from 100%. Previously, the message buffer rarely, if ever, dropped under 100% free.

After reading through various other user issues of the past, I found something that mentioned the "MsgBufferSize" settings in the registry. I went looking into the registry for those settings, however, "MsgBufferSize" was nowhere to be found. I added the "MsgBufferSize" with the value of "10000000", which is shown to be the max value. After adding the settings into the registry, and restarting everything, our system appears to be running fairly smooth, so far. Currently, we are roughly around 430K MPH, with a full 100% buffer free.

Previously posted thread regarding the "MsgBufferSize" registry entry:

Does the Kiwi Syslog buffer with SQL Server

Registry values documentation:

Kiwi Syslog Server

Section: HKEY_LOCAL_MACHINE\SOFTWARE\SolarWinds\Syslogd\Properties

 

Value (STRING): MsgBufferSize

 

 

Registered mode:

Min value:        100

Max value:        10000000 (10 million)

Default value:        500000

Type:                Maximum number of message buffer entries

So, did something change from 9.5.0 to 9.5.1 that would have removed those settings from the registry? If not, then what else would have removed the entry altogether? Or, has the "MsgBufferSize" registry entry been removed all along, and the documentation just not updated? If it has been removed, and is not used anymore, then why would adding the entry back into the registry make everything suddenly start working again?

Thank you,

-Will

The Release Candidate for Kiwi Syslog Server 9.5 is now ready! The new Kiwi Syslog version is packed with great new features and improvements. RC is the last step before general availability, and it is a chance for existing customers to get the newest functionality before it is available to everyone else. You can download it from the LATEST DOWNLOADS FOR YOUR PRODUCTS section of the customer portal. Change filter to "Release Candidate" and click on download button next to Kiwi Syslog RC version.

This release contains various improvements such as

• SNMP v3 Trap support
• SNMP Trap Forwarding
• Trap fields to VarBinds Elements in Output
• Logging to Papertrail cloud
• IPv6 Support
• Statistics email reports based on different interval
• Ability to create more than five web console users

RC builds are made available to existing customers prior to the formal release. These are used to get customer feedback in production environments and are fully supported. If you have any questions I encourage you to leverage the KSS forum on thwack.

Now go and download new version now!

I've technically got a two part question here and I'm pretty new to Syslog in general.  Our Kiwi Syslog server forwards it's logs to a SQL Server and I've got to bring the SQL Server down for a consistency repair that I can't fix offline at the moment.  Here's my questions.

1.  Will the Syslog buffer store messages that it's unable to transmit to the SQL or will it only store messages it can't process quick enough in it's own database? Because I can't lose any logs so if that's an issue I'll have to build a second sql to transfer the logs to.

2.  The default buffer shows as 500,000 and my registry doesn't list anything so I must have the default set up.  If I want to push it all the way to 10M (since this VM has tons of CPU/RAM) will I need to restart Kiwi for the change to take effect or will it query the registry after a certain interval for changes?