Current system on which Kiwi Syslog Server and viewer are installed is not working properly and we need to migrate to another system,
And SolarWinds License Manager does not reset Kiwi, ipMonitor, or LANsurveyor product licenses.

Kindly Solve the issue.

Thanks

Imran

↧

Syslog Message Logging to MYSQL DB

September 14, 2012, 3:03 pm

≫ Next: SolarWinds.SyslogServer.Engine.log

≪ Previous: How to Migrate Kiwi Syslog server and viewer to Another system

I am new to kiwi syslog server. Configured kiwi syslog server with default fields to log messages to MYSQL DB and working fine.

But I wish to parse the message and log to MYSQL DB using custom fields. I dont have any knowledge about scripting.

Sample log is shown below. Each field is separated by a single space character. The message content is highlighted in red.

2012-09-01 10:37:14 Local6.Warning HQ-IPS-01 DefensePro: 01-04-2012 19:49:25 WARNING 300000 Intrusions "BO-WINXP" TCP ACCTS-C-PC1 1607 ACCTS-C-PC2 80 3 Regular "DMZ-Policy" occur 1 0 N/A 0 N/A low drop FFFFFFFF-FFFF-FFFF-0001-00004F7B1BE5

Only the following things needs to be extracted and logged to DB.

MsgDate: 2012-09-01

MsgTime: 10:37:14

MsgHostname: HQ-IPS-01

AttackId: 300000

AttackType: Intrusions

AttackDesc: BO-WINXP

AttackSrc: ACCTS-C-PC1

AttackDst: ACCTS-C-PC2

The number of such logs that needs parsing by the script will be more.

Request provide me guidance in configuring this.

Any help on this would be greatly appreciated!

Thanks all...

↧

SolarWinds.SyslogServer.Engine.log

April 6, 2017, 11:52 am

≫ Next: Kiwi Syslog WebAccess Installation Error (error code is 2869)

≪ Previous: Syslog Message Logging to MYSQL DB

Hi, I was hoping someone can explain the log files ('SolarWinds.SyslogServer.Engine.log') created in the Syslogd folder to me. What purpose do they serve? Are they safe to delete? Can I set them to be created in a different directory?

Thank you.

↧

Kiwi Syslog WebAccess Installation Error (error code is 2869)

October 27, 2010, 8:29 pm

≫ Next: How to Split Log Files by IP Address and Date in Kiwi Syslog Server

≪ Previous: SolarWinds.SyslogServer.Engine.log

*Kiwi Syslog Server V.9.1.0
*Windows 2008 SP1 and SP2 64bit

Our client encountered a Kiwi Syslog WebAccess installation error.

The error message is as follows:
=============================================
The installer has encountered an unexpected error
installing this package. This may indicate a problem
with this package.The error code is 2869.
=============================================
*Kiwi Syslog Server service runs correctly.

*The client stopped Anti-Virus service before the installation.

Are there some information to resolve the problem?

↧

How to Split Log Files by IP Address and Date in Kiwi Syslog Server

May 31, 2013, 9:19 am

≫ Next: Forward syslog events to QRadar

≪ Previous: Kiwi Syslog WebAccess Installation Error (error code is 2869)

SolarWinds's own Justin Finley just recorded a video tutorial that shows how to split logs into multiple files by IP address and date in Kiwi Syslog Server. Specifically, this syslog server tutorial shows how to store logs in separate folders for each source IP address, and then shows how to keep separate log files for each day within those folders. (e.g., "D:\logs\192.168.000.001\Log2012-07-13.txt")

External link to Jing: autosplit - justinfinley's library

Video Guide:

0:00 Opening Kiwi Syslog's configuration dialog
0:15 Using an "AutoSplit" variable of "IP Address (4 octets)" (%IPAdd4) in the log path to split logs by IP address
0:40 Using an "AutoSplit" variable of "ISO Date" (%DateISO) in the log path to split logs by date

Remember to "LIKE" this if you find it useful - that helps other find it too!

↧

Forward syslog events to QRadar

January 13, 2016, 11:55 am

≫ Next: how to configure kiwi 9.4 syslog server for mikrotik in windows 7

≪ Previous: How to Split Log Files by IP Address and Date in Kiwi Syslog Server

I'm trying to forward events from Kiwi Syslog to QRadar SIEM.

In Kiwi Syslog setup, I created an Action: Forward to another host; gave it the QRadar appliance's IP as the Destination IP; selected "Retain the original source address of the message"; clicked the Test button to verify the configuration and got a gree checkmark.

The test event was the only event received by the QRadar. None of the events I'm forwarding have been received as incoming logs on QRadar.

I've tried this with and without adding the Kiwi Syslog servers as log sources in QRadar.

Do I need to install a universal DSM on the Kiwi Syslog servers?

↧

how to configure kiwi 9.4 syslog server for mikrotik in windows 7

July 1, 2017, 11:21 am

≫ Next: Kiwi Syslog Server Log Location won't change.

≪ Previous: Forward syslog events to QRadar

Dear All,

I try to configure kiwi 9.4 syslog server for mikrotik but failed. Would you please help to provide a step by step configuration method?

↧

Kiwi Syslog Server Log Location won't change.

September 17, 2012, 10:44 am

≫ Next: SYSLOG error with windows server 2012

≪ Previous: how to configure kiwi 9.4 syslog server for mikrotik in windows 7

Hey all,

I have recently taken over a sys admin position, and am required to move the location of the Kiwi Syslog Server logs to another file location. I have never used it prior. However, I can't seem to move the file.

Kiwi Syslog Server 9.2.1 (Free version.)

Windows Server 2003 SP2 (WORKGROUP)(VM)

Current configuration:

Log to Log File

Path and file name: C:\Program Files\Syslogd\Logs\SyslogCatchAll.txt

If I test the configuration, I can see the test messages in the location noted about. However, after I apply the settings, the older location (a CIFS share) continues to receive the actual syslogs of the devices we monitor.

There are three local users, all of which show the same configuration.

I have tried deleting and recreating the Log to Log File rule. No change.

I have tried starting and stopping the service. No change.

I have tried exporting the system settings, and then reimporting them. No change.

I have tried searching the registery for the old location. Nothing found.

I have two theories.

1. The settings are locked for some reason.

2. The settings are stored somewhere else.

Any help would be great.

Thanks,

Aaron

Solarwinds Padawan

↧

SYSLOG error with windows server 2012

June 9, 2015, 12:24 am

≫ Next: Kiwi Syslog advantages over PRTG syslog

≪ Previous: Kiwi Syslog Server Log Location won't change.

i am installing syslog in my server room to monitor the log in/log out operations on serers... i installed log forwarder on some windows server 2003 servers and everithig is ok but now i installed it on some windows server 2012 and all the messages that i receive from these servers are like this :''06-08-2015 17:03:47 Kernel.Info 172.19.12.119 giu 08 17.03.47 srv-av.astergenova.it MSWinEventLog 6 Application 127 lun giu 08 17.03.41 2015 1003 Microsoft-Windows-Security-SPP N/A Information srv-av.astergenova.it 0 The description for Event ID 1003 from source Microsoft-Windows-Security-SPP cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.If the event originated on another computer, the display information had to be saved with the event.The following information was included with the event: 55c92734-d682-4d71-983e-d6ec3f16059f. FormatMessage failed with error 15100, The resource loader failed to find MUI file."

do you have idea of how to fix this? syslogger is installed on a xp machine but i also tried to install it on a windows 2012 server machine and nothing changed

↧

Kiwi Syslog advantages over PRTG syslog

September 15, 2016, 1:10 pm

≫ Next: unity400f syslog configuration

≪ Previous: SYSLOG error with windows server 2012

Hi guys, my boss has asked me to consider moving our syslogging services to PRTG syslog. I am very happy with Kiwi Syslog and don't want to migrate.

I want to come up with a list of reasons why this is not a good idea i.e. what things KiwiSyslog does better.
Can someone who is familiar with both of these packages assist me.

Thanks kindly for any help.

↧

unity400f syslog configuration

April 17, 2017, 12:04 pm

≫ Next: Archive schedule task failure

≪ Previous: Kiwi Syslog advantages over PRTG syslog

Hi everyone,

please let me know how to configure unity device in kiwi syslog web access

Thanks in advance

↧

Archive schedule task failure

September 15, 2009, 8:36 am

≫ Next: no log shows on Kiwi Syslog Web Access

≪ Previous: unity400f syslog configuration

Using Syslog Service Manager Version 9.0.3 I am trying to archive the logs on an hourly basis. When I test the schedule with the run now it errors with: Task engine aborted with error: Problem copying file [Syslogd_Taskengine.exe 2.5.148] (45600) Main () Win32 file rename failed [Line: 0]

↧

no log shows on Kiwi Syslog Web Access

August 25, 2015, 11:44 am

≫ Next: sys log server errors "FormatMessage failed with 1815" help please!!

≪ Previous: Archive schedule task failure

I am having kiwi syslog 9.5 installed.

I choose to install as service and also installed the web access.

The syslog console opened fine and I see logs on displayed and also to file.

However, with the web access, it shows nothing (what so ever). I checked the Setup on Console Manager and see that under Rules i have 2 exact same option for "Log to Syslog Web Access". Everything under that options checked.

But I still see no log on web access.

1) I tried to uncheck all the "Log to Syslog Web Access".

2) Closed the Console Manager and reopened it

3) Checked mark one of the 2 optioins "Log to Syslog Web Access" and everything below it.

4) Opened and log in to web access -> Still see nothing.

any idea?

↧

sys log server errors "FormatMessage failed with 1815" help please!!

April 8, 2015, 2:19 pm

≫ Next: Can I install Kiwi Syslog alongside my NPM?

≪ Previous: no log shows on Kiwi Syslog Web Access

Good day Community,

I am experiencing an urgent issue. The sys log server forwarder is forwarding the following message to the KIWI sys log server. The actual security logs are showing the correct information, however the message below is being showed. I thought it was the server, but wen I added another sever to forward security logs, I am getting the same message as shown below.

Can anyone who have encountered this message or know how to resolve this issue. The security logs are on the server and I can view them using event viewer properly and audit logs are reflecting fine.

I would really appreciate your humble assistance or comments.

Apr 08 14:36:34 CASSIOPEIA1.carimed.local MSWinEventLog 5 Security 495 Wed Apr 08 14:36:33 2015

4624 Microsoft-Windows-Security-Auditing N/A Audit Success CASSIOPEIA1.carimed.local 12544

The description for Event ID 4624 from source Microsoft-Windows-Security-Auditing cannot be

found. Either the component that raises this event is not installed on your local computer or

the installation is corrupted. You can install or repair the component on the local computer.If

the event originated on another computer, the display information had to be saved with the

event.The following information was included with the event: S-1-0-0. FormatMessage failed with

error 1815, The specified resource language ID cannot be found in the image file.

↧

Can I install Kiwi Syslog alongside my NPM?

December 17, 2015, 1:11 pm

≫ Next: SolarWinds.SyslogServer.Engine.log

≪ Previous: sys log server errors "FormatMessage failed with 1815" help please!!

Would there be any interference? Is this recommended or supported?

↧

SolarWinds.SyslogServer.Engine.log

April 6, 2017, 11:52 am

≫ Next: How many messages per hour can Kiwi Syslog handle without dropping messages?

≪ Previous: Can I install Kiwi Syslog alongside my NPM?

Thank you.

↧

How many messages per hour can Kiwi Syslog handle without dropping messages?

June 2, 2015, 1:13 pm

≫ Next: Kiwi Syslog Server Web Access can't start

≪ Previous: SolarWinds.SyslogServer.Engine.log

How many messages per hour can the syslog server reliably handle per hour or per second before dropping / skipping / missing messages and failing to trigger alerts?

↧

Kiwi Syslog Server Web Access can't start

November 26, 2010, 4:44 am

≫ Next: Problem with filtering in Kiwi Syslog

≪ Previous: How many messages per hour can Kiwi Syslog handle without dropping messages?

Hello!

I install Kiwi Syslog Server & Web Access.

Kiwi Syslog Server start and i see events from my devices, but when i start Kiwi Syslog Server Web Access its could not start:

"Kiwi Syslog WebAccess requires Kiwi Syslog Server to be online, but it is offline"

What's problem?

Version 9.2

↧

Problem with filtering in Kiwi Syslog

December 12, 2011, 1:15 pm

≫ Next: Forward Event Viewer subscriptions with Event Log Forwarder for Windows

≪ Previous: Kiwi Syslog Server Web Access can't start

I am setting up a kiwi syslog server. Running into a problem with the filtering not working the way I would expect. I have used Kiwi but that was several years ago. I have setup a display for a specific switch and have tried several different filter possibilities but still getting syslog messages on the display that dont belong to the switch I am trying to watch.

I have tried a ip address - simple filter with the ip address of the switch "10.1.1.2". On the cisco switch, I have used the command logging source-interface vlan 254 which should send out the syslog messages using the ip address in the simple filter I setup. I have also tried the hostname option with the hostname of the switch "Switch1" but same problem.

It has got to be something simple but so far I havent found the problem. Since this is the free version, I know I cant call Solar Winds support.

Any suggestions are appreciated.

Ron

↧