Server 2008 R2 Std

Kiwi Syslog Server 9.4.1

I have an older version of Kiwi installed on an old server that is being retired.  I've installed it on the new server, but I cannot get it to display anything.  I exported settings from the other server and imported on this one, then went to Inputs-UDP and set the correct IP to bind it to.

• I've gone through ALL the steps at SolarWinds Knowledge Base :: Kiwi Syslog Daemon is not receiving messages and Kiwi Syslog Server but had no luck getting it to work.
• I know for a fact that messages are being received -- when I run WireShark with the filter, "udp port 514", I see PLENTY of traffic from my firewall.  Both my firewall and VPN device are sending syslog messages to the old server and the new one.  The old server is still working just fine.
• Windows Firewall on the new server is completely disabled.
• I loaded the default rules and settings but still had no luck.
• I disabled all DNS resolution - no luck.
• There is no Errorlog.txt in C:\Program Files (x86)\Syslogd.
• Test messages from within Kiwi work just fine.
• I finally uninstalled Kiwi, rebooted the server, then reinstalled, and have the same problem.

Kiwi is running as LocalService -- I wondered if that might be the problem, but that's how it's running on the old server as well.

I'm at a loss as to what to do now.  I tried contacting support, but since I'm using the free version I was directed here.

Good day Community,

I am experiencing an urgent issue. The sys log server forwarder is forwarding the following message to the KIWI sys log server. The actual security logs are showing the correct information, however the message below is being showed. I thought it was the server, but wen I added another sever to forward security logs, I am getting the same message as shown below.

Can anyone who have encountered this message or know how to resolve this issue. The security logs are on the server and I can view them using event viewer properly and audit logs are reflecting fine.

I would really appreciate your humble assistance or comments.

Apr 08 14:36:34 CASSIOPEIA1.carimed.local MSWinEventLog 5 Security 495 Wed Apr 08 14:36:33 2015

4624 Microsoft-Windows-Security-Auditing N/A Audit Success CASSIOPEIA1.carimed.local 12544

The description for Event ID 4624 from source Microsoft-Windows-Security-Auditing cannot be

found. Either the component that raises this event is not installed on your local computer or

the installation is corrupted. You can install or repair the component on the local computer.If

the event originated on another computer, the display information had to be saved with the

event.The following information was included with the event: S-1-0-0. FormatMessage failed with

error 1815, The specified resource language ID cannot be found in the image file.

Which method should be used to calculate a Syslog message priority?

We are having problems getting EMET to allow the kiwi syslog server service to run on an Windows 2012 R2 Server VM.  We have case 999667 open and still haven't gotten it working.  One of my partners working on this opened the case.

Hi,

We are using the Kiwi Syslog Web Access as a syslog for all the network and security devices. Due to this we are unable to fetch events for any specific filters applied on the Kiwi Syslog Web Access.

We alternatively go to the location: \Program Files (x86)\Syslogd\Logs and try to open the logs in text editor like notepad++.

The problem is:

1. That file size is too large (~700 MB) and we are unable to open via the text editor. Is there any way to limit the size.

2. On the Web Access, when a filter is applied, the software crashes with the error:

Exception of type 'System.Web.HttpUnhandledException' was thrown.

Status Code: 500

System.Web.HttpUnhandledException: Exception of type 'System.Web.HttpUnhandledException' was thrown. ---> System.Web.HttpException: Maximum request length exceeded.
  at System.Web.HttpRequest.GetEntireRawContent()
  at System.Web.HttpRequest.FillInFormCollection()
  at System.Web.HttpRequest.get_Form()
  at System.Web.HttpRequest.get_HasForm()
  at System.Web.UI.Page.GetCollectionBasedOnMethod(Boolean dontReturnNull)
  at System.Web.UI.Page.DeterminePostBackMode()
  at System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)
  --- End of inner exception stack trace ---
  at System.Web.UI.Page.HandleError(Exception e)
  at System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)
  at System.Web.UI.Page.ProcessRequest(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)
  at System.Web.UI.Page.ProcessRequest()
  at System.Web.UI.Page.ProcessRequestWithNoAssert(HttpContext context)
  at System.Web.UI.Page.ProcessRequest(HttpContext context)
  at ASP.events_aspx.ProcessRequest(HttpContext context)
  at System.Web.HttpApplication.CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()
  at System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously)

Resource: http://10.240.22.194:8088/Events.aspx
Referrer: http://10.240.22.194:8088/Events.aspx

Click here to return to the previous page    Click here to return to the login page

Please suggest.

Details: Kiwi Syslog Web Access ver 1.5.1

Thanks,

Richard

Hi,

I'm trying to install Kiwi but the only thing that happens is the counting the percentage from 0-100%. Thats all.

I had a version of Kiwi installed, then uninstalled. Now I need to install it again but this fails without any error message.

I found a thread suggesting to run the licence manager which may throw any error message but even that doesnt help.

Do you have any idea how to get Kiwi installed again?

Thanks,

crowstone

Hello All,

I am just beginning to use Kiwi SysLog server and I am first testing on the free version 9.5. I have 2 inputs currently coming in just fine but I am trying to use the autosplit log to file by "hostname" or "host IP" but it is grayed out. Is that because this is a trial or am I missing a step?

Thanks!

I am trying to find out if Kiwi has the ability to delete syslogs in the MSSQL database after so many days? Or do I need to create a job on the SQL server to do that?

Thanks for any help you may be able to offer..

Hello Everybody.

I'm having troubles receiving SNMP Traps v 2c on Kiwi Syslog Server Free edition.

Although it is described in the feature list that this is supported (also in the documentation), i can receive version 1 but not 2c.

Using Wireshark to listen to the traffic i can clearly see SNMP traps version 2 incoming, but nothing appears on syslog server.

Can anyone help?

I asked support@ and sent many mails, but didn't get any answer to the problem, they just said to post my question here because this is a free product.

Thank you very much.

We have been experiencing an issue with our Kiwi Syslog Service crashing about every other day.  We are running version 9 and have a pretty standard setup where we are pushing syslogs from all of our devices in our network.  We have quite a bit of stuff logging to our Syslog server and are easily breaching the 200000 maximum message count throughout the day and getting email's.  We up'ed that and seem to be doing better however the syslog service continues to fail and will at times restart itself based off of the services recovery failure to restart the service but this is happening way to often. 

Has anyone else seen this problem and if so, what kinds of things did you try/do?  Is this box just getting pegged so hard that it's causing the service to malfunction and trip up?  I'm not a Windows guy but is this issue even Windows related?  The only other application we have running on this server is CatTools and it runs clean with no service issues.  The systems team has taken a look at the server and believe this to be related only to the Kiwi application itself. 

Next Steps: I'm thinking of removing and rebuilding the Kiwi 9 application from scratch to see if this corrects the issue but wanted some direction from the forum if anyone has any good ideas/suggestions.

Thankyou in advance!

Hi all,

I can't install Kiwi Syslog Web Access. Syslog server is installing fine but Web Access is just says that there is an error and rolls back. I had evaluated version installed before and now trying to install licensed.

Hello , kiwi friends!

I am trying to get Kiwi syslog 9.4 to work on windows server 2012 64bit but having problems with the service crashing then i try to start the kiwi syslog server console.

I have applied the kb fix for Microsoft .Net Framework 2 , before that i couldnt install kiwi syslog successfully becuse the service could not start.

http://knowledgebase.solarwinds.com/kb/questions/4386/

I have the following errors in the windows event viewer!

Error 7000: The Kiwi Syslog Server service failed to start due to the following error:
The service did not respond to the start or control request in a timely fashion

Error 7009 : A timeout was reached (30000 milliseconds) while waiting for the Kiwi Syslog Server service to connect.

Do you have a solution for this or could it be a new bug in windows server 2012 and the old dot net framework combined ?

Thanks in advance.

We have a couple of Forescout NAC devices. They are configured to forward to our local Kiwi servers, and then rules on the Kiwi are supposed to be sending warning & above messages to the main Orion server. Unfortunately, I have oodles (technical term) of info messages showing in the main repository. I'm pretty sure the Kiwi rules are correct (they are working for other devices) but our on site security guy isn't a Forescout expert, so he hasn't been able to see anything wrong on the NAC itself. I'm thinking we have it set to forward directly to Orion under a different facility, but that's a pure guess. From what I've seen of the NAC's SYSLOG setup there aren't drop downs to look at different facilities.

Does anyone have experience with this? Thanks in advance!

I have a Cisco ASA 5505 that is setup to send syslogs to a remote syslog server.

I have kiwi syslog (free) installed on a Windows 2003 R2 Server and it is listening on UDP port 514. The syslog server also is my Ciscoworks v3.2 server.

I can ONLY see the Ciscoworks log files and not the ASA. I only want to display the ASA log files.

I have googled, read the user guide, and search the forum and cannot find any procedure that I can tweak Kiwi to log the syslog files from my ASA which is being used as a VPN concentrator.

Any ideas?

It would be a huge space saver if Kiwi Syslog had the ability to ZIP/Archive files when it rotated them as part of the "Log to file" option.

Hello Everybody.

I'm having troubles receiving SNMP Traps v 2c on Kiwi Syslog Server Free edition.

Although it is described in the feature list that this is supported (also in the documentation), i can receive version 1 but not 2c.

Using Wireshark to listen to the traffic i can clearly see SNMP traps version 2 incoming, but nothing appears on syslog server.

Can anyone help?

I asked support@ and sent many mails, but didn't get any answer to the problem, they just said to post my question here because this is a free product.

Thank you very much.

Hi,

Version hisory of Kiwi syslog on

http://www.kiwisyslog.com/index.php?option=com_changelog&Itemid=119

says, bug fix on 8.0.0Beta,

what's "Italian systems"?

I have serched that on your knowledge DB and forums

and on Google, but was not able to find exact answer.

What does it mean?

Using Kiwi Syslog (ver. 9.3) with log forwarder for windows (ver 1.1). Have one 2003 server that will not forward events of any type to the syslog server. All other servers in environment, both 2003 and 2008, will forward to syslog server. Have made exceptions in firewall rules, opened up port 514 and turned off firewall all together. Still no go. Test messages can be created, but not sent and actual events show up in security log (unsuccessful log in, event id 529) but are not forwarded. Any ideas on what to check next or is this just an unhappy old server that will not cooperate?

i have a powershell script to parse syslog messages, at the start of the script i write a log to a file and have noticed that they dont seem to be running in order even thou on the action i configured "wait for the program to initialization to complete before continuing" (max wait time 9000 ms)

you can see from the log that sometimes the script runs before the last log has even written to the file. how can i force the actions to run in order? i have tried running the external program (powershell) with process priority of high and even realtime which hasnt resolved the issue?

IPADDRESS.66,Aug 19 07:47:51 SWITCH-1 Ebra: %LINEPROTO-5-UPDOWN: Line protocol on Interface Ethernet5 (elkhdp146-ens1f0), changed state to down

IPADDRESS.66,Aug 19 07:47:52 SWITCH-1 Ebra: %LINEPROTO-5-UPDOWN: Line protocol on Interface Ethernet5 (elkhdp146-ens1f0), changed state to up

IPADDRESS.66,Aug 19 07:47:52 SWITCH-1 Ebra: %LINEPROTO-5-UPDOWN: Line protocol on Interface Ethernet5 (elkhdp146-ens1f0), changed state to up

IPADDRESS.66,Aug 19 07:47:51 SWITCH-1 Ebra: %LINEPROTO-5-UPDOWN: Line protocol on Interface Ethernet5 (elkhdp146-ens1f0), changed state to down

IPADDRESS.66,Aug 19 07:48:10 SWITCH-1 Ebra: %LINEPROTO-5-UPDOWN: Line protocol on Interface Ethernet5 (elkhdp146-ens1f0), changed state to down

IPADDRESS.66,Aug 19 07:48:10 SWITCH-1 Ebra: %LINEPROTO-5-UPDOWN: Line protocol on Interface Ethernet5 (elkhdp146-ens1f0), changed state to down

IPADDRESS.66,Aug 19 07:48:11 SWITCH-1 Ebra: %LINEPROTO-5-UPDOWN: Line protocol on Interface Ethernet5 (elkhdp146-ens1f0), changed state to up

IPADDRESS.66,Aug 19 07:48:11 SWITCH-1 Ebra: %LINEPROTO-5-UPDOWN: Line protocol on Interface Ethernet5 (elkhdp146-ens1f0), changed state to up

IPADDRESS.66,Aug 19 07:48:13 SWITCH-1 Ebra: %LINEPROTO-5-UPDOWN: Line protocol on Interface Ethernet5 (elkhdp146-ens1f0), changed state to down

IPADDRESS.66,Aug 19 07:48:13 SWITCH-1 Ebra: %LINEPROTO-5-UPDOWN: Line protocol on Interface Ethernet5 (elkhdp146-ens1f0), changed state to down

IPADDRESS.66,Aug 19 07:48:18 SWITCH-1 Ebra: %LINEPROTO-5-UPDOWN: Line protocol on Interface Ethernet5 (elkhdp146-ens1f0), changed state to down

IPADDRESS.66,Aug 19 07:48:15 SWITCH-1 Ebra: %LINEPROTO-5-UPDOWN: Line protocol on Interface Ethernet5 (elkhdp146-ens1f0), changed state to up

IPADDRESS.66,Aug 19 07:48:15 SWITCH-1 Ebra: %LINEPROTO-5-UPDOWN: Line protocol on Interface Ethernet5 (elkhdp146-ens1f0), changed state to up

IPADDRESS.66,Aug 19 07:48:18 SWITCH-1 Ebra: %LINEPROTO-5-UPDOWN: Line protocol on Interface Ethernet5 (elkhdp146-ens1f0), changed state to down

IPADDRESS.66,Aug 19 07:48:20 SWITCH-1 Ebra: %LINEPROTO-5-UPDOWN: Line protocol on Interface Ethernet5 (elkhdp146-ens1f0), changed state to up

IPADDRESS.66,Aug 19 07:48:20 SWITCH-1 Ebra: %LINEPROTO-5-UPDOWN: Line protocol on Interface Ethernet5 (elkhdp146-ens1f0), changed state to up

IPADDRESS.66,Aug 19 07:48:33 SWITCH-1 Ebra: %LINEPROTO-5-UPDOWN: Line protocol on Interface Ethernet5 (elkhdp146-ens1f0), changed state to down

IPADDRESS.66,Aug 19 07:48:33 SWITCH-1 Ebra: %LINEPROTO-5-UPDOWN: Line protocol on Interface Ethernet5 (elkhdp146-ens1f0), changed state to down

IPADDRESS.66,Aug 19 07:48:35 SWITCH-1 Ebra: %LINEPROTO-5-UPDOWN: Line protocol on Interface Ethernet5 (elkhdp146-ens1f0), changed state to up

IPADDRESS.66,Aug 19 07:48:35 SWITCH-1 Ebra: %LINEPROTO-5-UPDOWN: Line protocol on Interface Ethernet5 (elkhdp146-ens1f0), changed state to up

IPADDRESS.66,Aug 19 07:48:37 SWITCH-1 Ebra: %LINEPROTO-5-UPDOWN: Line protocol on Interface Ethernet5 (elkhdp146-ens1f0), changed state to down

IPADDRESS.66,Aug 19 07:48:37 SWITCH-1 Ebra: %LINEPROTO-5-UPDOWN: Line protocol on Interface Ethernet5 (elkhdp146-ens1f0), changed state to down

IPADDRESS.66,Aug 19 07:48:39 SWITCH-1 Ebra: %LINEPROTO-5-UPDOWN: Line protocol on Interface Ethernet5 (elkhdp146-ens1f0), changed state to up

IPADDRESS.66,Aug 19 07:48:39 SWITCH-1 Ebra: %LINEPROTO-5-UPDOWN: Line protocol on Interface Ethernet5 (elkhdp146-ens1f0), changed state to up

IPADDRESS.66,Aug 19 07:48:41 SWITCH-1 Ebra: %LINEPROTO-5-UPDOWN: Line protocol on Interface Ethernet5 (elkhdp146-ens1f0), changed state to up

IPADDRESS.66,Aug 19 07:48:41 SWITCH-1 Ebra: %LINEPROTO-5-UPDOWN: Line protocol on Interface Ethernet5 (elkhdp146-ens1f0), changed state to up

IPADDRESS.66,Aug 19 07:48:41 SWITCH-1 Ebra: %LINEPROTO-5-UPDOWN: Line protocol on Interface Ethernet5 (elkhdp146-ens1f0), changed state to down

IPADDRESS.66,Aug 19 07:48:44 SWITCH-1 Ebra: %LINEPROTO-5-UPDOWN: Line protocol on Interface Ethernet5 (elkhdp146-ens1f0), changed state to down

IPADDRESS.66,Aug 19 07:48:44 SWITCH-1 Ebra: %LINEPROTO-5-UPDOWN: Line protocol on Interface Ethernet5 (elkhdp146-ens1f0), changed state to down

IPADDRESS.66,Aug 19 07:48:47 SWITCH-1 Ebra: %LINEPROTO-5-UPDOWN: Line protocol on Interface Ethernet5 (elkhdp146-ens1f0), changed state to up

IPADDRESS.66,Aug 19 07:48:47 SWITCH-1 Ebra: %LINEPROTO-5-UPDOWN: Line protocol on Interface Ethernet5 (elkhdp146-ens1f0), changed state to up

IPADDRESS.66,Aug 19 07:49:04 SWITCH-1 Ebra: %LINEPROTO-5-UPDOWN: Line protocol on Interface Ethernet5 (elkhdp146-ens1f0), changed state to down

IPADDRESS.66,Aug 19 07:49:04 SWITCH-1 Ebra: %LINEPROTO-5-UPDOWN: Line protocol on Interface Ethernet5 (elkhdp146-ens1f0), changed state to down

IPADDRESS.66,Aug 19 07:49:06 SWITCH-1 Ebra: %LINEPROTO-5-UPDOWN: Line protocol on Interface Ethernet5 (elkhdp146-ens1f0), changed state to up

IPADDRESS.66,Aug 19 07:49:06 SWITCH-1 Ebra: %LINEPROTO-5-UPDOWN: Line protocol on Interface Ethernet5 (elkhdp146-ens1f0), changed state to up

IPADDRESS.66,Aug 19 07:55:05 SWITCH-1 Ebra: %LINEPROTO-5-UPDOWN: Line protocol on Interface Ethernet5 (elkhdp146-ens1f0), changed state to down

IPADDRESS.66,Aug 19 07:55:06 SWITCH-1 Ebra: %LINEPROTO-5-UPDOWN: Line protocol on Interface Ethernet5 (elkhdp146-ens1f0), changed state to up

IPADDRESS.66,Aug 19 07:55:05 SWITCH-1 Ebra: %LINEPROTO-5-UPDOWN: Line protocol on Interface Ethernet5 (elkhdp146-ens1f0), changed state to down

IPADDRESS.66,Aug 19 07:55:06 SWITCH-1 Ebra: %LINEPROTO-5-UPDOWN: Line protocol on Interface Ethernet5 (elkhdp146-ens1f0), changed state to up

IPADDRESS.66,Aug 19 07:55:45 SWITCH-1 Ebra: %LINEPROTO-5-UPDOWN: Line protocol on Interface Ethernet5 (elkhdp146-ens1f0), changed state to down

IPADDRESS.66,Aug 19 07:55:46 SWITCH-1 Ebra: %LINEPROTO-5-UPDOWN: Line protocol on Interface Ethernet5 (elkhdp146-ens1f0), changed state to up

IPADDRESS.66,Aug 19 07:55:46 SWITCH-1 Ebra: %LINEPROTO-5-UPDOWN: Line protocol on Interface Ethernet5 (elkhdp146-ens1f0), changed state to up

IPADDRESS.66,Aug 19 07:55:45 SWITCH-1 Ebra: %LINEPROTO-5-UPDOWN: Line protocol on Interface Ethernet5 (elkhdp146-ens1f0), changed state to down

IPADDRESS.66,Aug 19 07:55:49 SWITCH-1 Ebra: %LINEPROTO-5-UPDOWN: Line protocol on Interface Ethernet5 (elkhdp146-ens1f0), changed state to down

IPADDRESS.66,Aug 19 07:55:49 SWITCH-1 Ebra: %LINEPROTO-5-UPDOWN: Line protocol on Interface Ethernet5 (elkhdp146-ens1f0), changed state to down

IPADDRESS.66,Aug 19 07:55:51 SWITCH-1 Ebra: %LINEPROTO-5-UPDOWN: Line protocol on Interface Ethernet5 (elkhdp146-ens1f0), changed state to up

IPADDRESS.66,Aug 19 07:55:51 SWITCH-1 Ebra: %LINEPROTO-5-UPDOWN: Line protocol on Interface Ethernet5 (elkhdp146-ens1f0), changed state to up

IPADDRESS.66,Aug 19 07:55:59 SWITCH-1 Ebra: %LINEPROTO-5-UPDOWN: Line protocol on Interface Ethernet5 (elkhdp146-ens1f0), changed state to up

IPADDRESS.66,Aug 19 07:55:59 SWITCH-1 Ebra: %LINEPROTO-5-UPDOWN: Line protocol on Interface Ethernet5 (elkhdp146-ens1f0), changed state to up

IPADDRESS.66,Aug 19 07:56:07 SWITCH-1 Ebra: %LINEPROTO-5-UPDOWN: Line protocol on Interface Ethernet5 (elkhdp146-ens1f0), changed state to up

IPADDRESS.66,Aug 19 07:55:59 SWITCH-1 Ebra: %LINEPROTO-5-UPDOWN: Line protocol on Interface Ethernet5 (elkhdp146-ens1f0), changed state to down

IPADDRESS.66,Aug 19 07:55:59 SWITCH-1 Ebra: %LINEPROTO-5-UPDOWN: Line protocol on Interface Ethernet5 (elkhdp146-ens1f0), changed state to down

IPADDRESS.66,Aug 19 07:56:07 SWITCH-1 Ebra: %LINEPROTO-5-UPDOWN: Line protocol on Interface Ethernet5 (elkhdp146-ens1f0), changed state to up

IPADDRESS.66,Aug 19 07:56:06 SWITCH-1 Ebra: %LINEPROTO-5-UPDOWN: Line protocol on Interface Ethernet5 (elkhdp146-ens1f0), changed state to down

IPADDRESS.66,Aug 19 07:56:06 SWITCH-1 Ebra: %LINEPROTO-5-UPDOWN: Line protocol on Interface Ethernet5 (elkhdp146-ens1f0), changed state to down

IPADDRESS.66,Aug 19 07:58:32 SWITCH-1 Ebra: %LINEPROTO-5-UPDOWN: Line protocol on Interface Ethernet5 (elkhdp146-ens1f0), changed state to down

IPADDRESS.66,Aug 19 07:58:32 SWITCH-1 Ebra: %LINEPROTO-5-UPDOWN: Line protocol on Interface Ethernet5 (elkhdp146-ens1f0), changed state to down

IPADDRESS.66,Aug 19 07:58:33 SWITCH-1 Ebra: %LINEPROTO-5-UPDOWN: Line protocol on Interface Ethernet5 (elkhdp146-ens1f0), changed state to up

IPADDRESS.66,Aug 19 07:58:33 SWITCH-1 Ebra: %LINEPROTO-5-UPDOWN: Line protocol on Interface Ethernet5 (elkhdp146-ens1f0), changed state to up

IPADDRESS.66,Aug 19 07:58:44 SWITCH-1 Ebra: %LINEPROTO-5-UPDOWN: Line protocol on Interface Ethernet5 (elkhdp146-ens1f0), changed state to down

IPADDRESS.66,Aug 19 07:58:44 SWITCH-1 Ebra: %LINEPROTO-5-UPDOWN: Line protocol on Interface Ethernet5 (elkhdp146-ens1f0), changed state to down

IPADDRESS.66,Aug 19 07:58:45 SWITCH-1 Ebra: %LINEPROTO-5-UPDOWN: Line protocol on Interface Ethernet5 (elkhdp146-ens1f0), changed state to up

IPADDRESS.66,Aug 19 07:58:45 SWITCH-1 Ebra: %LINEPROTO-5-UPDOWN: Line protocol on Interface Ethernet5 (elkhdp146-ens1f0), changed state to up

IPADDRESS.66,Aug 19 07:58:56 SWITCH-1 Ebra: %LINEPROTO-5-UPDOWN: Line protocol on Interface Ethernet5 (elkhdp146-ens1f0), changed state to down

IPADDRESS.66,Aug 19 07:58:56 SWITCH-1 Ebra: %LINEPROTO-5-UPDOWN: Line protocol on Interface Ethernet5 (elkhdp146-ens1f0), changed state to down

IPADDRESS.66,Aug 19 07:58:57 SWITCH-1 Ebra: %LINEPROTO-5-UPDOWN: Line protocol on Interface Ethernet5 (elkhdp146-ens1f0), changed state to up

IPADDRESS.66,Aug 19 07:58:57 SWITCH-1 Ebra: %LINEPROTO-5-UPDOWN: Line protocol on Interface Ethernet5 (elkhdp146-ens1f0), changed state to up

IPADDRESS.66,Aug 19 07:59:02 SWITCH-1 Ebra: %LINEPROTO-5-UPDOWN: Line protocol on Interface Ethernet5 (elkhdp146-ens1f0), changed state to down

IPADDRESS.66,Aug 19 07:59:04 SWITCH-1 Ebra: %LINEPROTO-5-UPDOWN: Line protocol on Interface Ethernet5 (elkhdp146-ens1f0), changed state to up

IPADDRESS.66,Aug 19 07:59:02 SWITCH-1 Ebra: %LINEPROTO-5-UPDOWN: Line protocol on Interface Ethernet5 (elkhdp146-ens1f0), changed state to down

IPADDRESS.66,Aug 19 07:59:04 SWITCH-1 Ebra: %LINEPROTO-5-UPDOWN: Line protocol on Interface Ethernet5 (elkhdp146-ens1f0), changed state to up

IPADDRESS.66,Aug 19 07:59:48 SWITCH-1 Ebra: %LINEPROTO-5-UPDOWN: Line protocol on Interface Ethernet5 (elkhdp146-ens1f0), changed state to down

*Kiwi Syslog Server V.9.1.0
*Windows 2008 SP1 and SP2 64bit

Our client encountered a Kiwi Syslog WebAccess installation error.

The error message is as follows:
=============================================
The installer has encountered an unexpected error
installing this package. This may indicate a problem
with this package.The error code is 2869.
=============================================
*Kiwi Syslog Server service runs correctly.

*The client stopped Anti-Virus service before the installation.

Are there some information to resolve the problem?