Quantcast
Channel: THWACK: Popular Discussions - Kiwi Syslog
Viewing all 15803 articles
Browse latest View live
↧

sys log server errors "FormatMessage failed with 1815" help please!!

April 8, 2015, 2:19 pm
$
0
0

Good day Community,

 

I am experiencing an urgent issue. The sys log server forwarder is forwarding the following message to the KIWI sys log server. The actual security logs are showing the correct information, however the message below is being showed. I thought it was the server, but wen I added another sever to forward security logs, I am getting the same message as shown below.

 

Can anyone who have encountered this message or know how to resolve this issue. The security logs are on the server and I can view them using event viewer properly and audit logs are reflecting fine.

 

I would really appreciate your humble assistance or comments.

 

 

 

Apr 08 14:36:34 CASSIOPEIA1.carimed.local MSWinEventLog 5 Security 495 Wed Apr 08 14:36:33 2015

4624 Microsoft-Windows-Security-Auditing N/A Audit Success CASSIOPEIA1.carimed.local 12544

The description for Event ID 4624 from source Microsoft-Windows-Security-Auditing cannot be

found. Either the component that raises this event is not installed on your local computer or

the installation is corrupted. You can install or repair the component on the local computer.If

the event originated on another computer, the display information had to be saved with the

event.The following information was included with the event: S-1-0-0. FormatMessage failed with

error 1815, The specified resource language ID cannot be found in the image file.

↧
Search

Problem with Syslog Message Delay and out of Order.

September 2, 2010, 7:37 am
$
0
0

Has anyone experienced a problem where their Syslogs messages are delayed and out of order?
Note the time the time it was queued and then the time it was sent.   Sent at 8:31, but the message came into the syslog server at 7:28.

2010-08-24 08:31:25 PI Message to: networkadmin@removed.net

2010-08-24 08:31:25 PI Message from: Ospf-Syslog

2010-08-24 08:31:25 PI Subject: 10.5.0.2: 3552813: Aug 24 07:28:31.274: %OSPF-5-ADJCHG: Process 1, Nbr 10.12.1.41 on Vlan600 from F

2010-08-24 08:31:25 PI Date: Tue, 24 Aug 2010 08:31:25 -0400

2010-08-24 08:31:25 PI Message to: networkadmin@removed.net

2010-08-24 08:31:25 PI Message from: Ospf-Syslog

2010-08-24 08:31:25 PI Subject: 10.128.254.230: 49512: 049509: Aug 24 07:28:31: %OSPF-5-ADJCHG: Process 1, Nbr 10.12.1.41 on Vlan60

2010-08-24 08:31:25 PI Date: Tue, 24 Aug 2010 08:31:25 -0400

2010-08-24 08:31:25 PI Message to: networkadmin@removed.net

2010-08-24 08:31:25 PI Message from: HSRP-Syslog

2010-08-24 08:31:25 PI Subject: HSRP message from 10.7.4.2

2010-08-24 08:31:25 PI Date: Tue, 24 Aug 2010 08:31:25 -0400

↧
↧

Windows Events 6005, 6006, 6008, 6009 and 1074 not logging in kiwi syslog server

September 27, 2017, 4:21 am
$
0
0

Hello Everyone,

First time poster here. I am trying to track event log service status and power downs. I cannot get the windows machines to forward event logs  6005, 6006, 6008, 6009 and 1074.

 

I have event log forwarder configured correctly, at least the log preview shows the correct logs being forwarded. I do have a custom filter built just for these event IDs but I also have a catch all file that is not filtered. I am checking in both the web access and the syslog server itself. Neither of them receive these event logs from the windows machines. I haven't noticed any other events not being forwarded. All of my other filters are producing the information correctly.

 

Any tips on how to collect these logs?

 

Windows 2012R2 and Windows 7 Enviorment

Using Kiwi Syslog Server 9.6 and Event log Forwarder

↧

Can I install Kiwi 9.3.4 in Windows Server 2012 R2

February 8, 2017, 1:04 pm
$
0
0

I currently have a Kiwi Syslog (9.3.4) on a Windows Server 2003 R2 (x64) and would like to know the following;

 

1. Can I install the current version (9.3.4) into a newly build Windows Server 2012 R2 machine? Is it compatible with Server 2012 R2?  If yes, can I move the database of the old Kiwi to the newly installed Kiwi Syslog server? If no;

2. Can I install the new version (9.5) into a newly build Windows Server 2012 R2 without buying a new license?

 

Thanks guys.

↧

log forwarder and dhcp auditing?

October 15, 2011, 10:57 am
$
0
0

I am needing to forward all of our DHCP audits to the syslog, however I cannot figure out how to do that with the Log Forwarder.  Which source do I use in the Event Viewer?  The audit is logged to a file.  Is there any way to forward changes to files?

↧
↧

Administrator Password Missed; Other way to login

April 17, 2015, 2:56 am
$
0
0

Hi,

 

I have recently been handed over Kiwi Syslog server to manage which has both Fat Client and Web Server. Fat Client is directly logged in however Web console could not be logged in. When I checked regarding the password of "Administrator", I have been informed that resource handling it has left long ago and there is no one to tell.

 

Is there a way we can reset the password of Administrator or create a new user from Syslog Fat Client. I cant raise the request with Support as we do not have active maintanence.

 

Thanks,

Syed

↧

LogForwarderClient and EnforceFIPSPolicy

July 19, 2017, 11:21 pm
$
0
0

We have noticed that

enforceFIPSPolicy enabled=false under windows\logforwarderclient.exe.config

This may be problematic on our system - can this section be removed or be set to true ?

Thanks,

Tal

↧

syslog server backup and restore

February 25, 2013, 7:33 am
$
0
0

Hi,

 

I am in the process of moving kiwi syslog server v9 from one system to other system. want to check if there is a simple process to migrate all settings instead of reconfiguring.

 

Thanks,

Sridhar

↧
Search

how to setup snort-log link to syslog server?

April 24, 2017, 12:31 pm
$
0
0

how to setup snort-log link to syslog server?

 

in snort.conf  (windows 7 32 bits)

output alert_syslog: host=127.0.0.1:8080, LOG_AUTH LOG_ALERT

 

command :

snort -i 1 -c c:\snort\etc\snort.conf -s

 

then get a file in c:\snort\log\snort.log.1493058792.

 

please tell me, how to send log to syslog server?

 

thank you

↧
↧

Exclude a user from log forwarding

October 26, 2017, 1:54 pm
$
0
0

We have a managed service account that we use for Solarwinds. It is appearing in our logs a lot because it is used in NPM and SAM to get info from all of the systems in our domain for SolarWinds. Is there a way to exclude any logs containing that username from being forwarded?

 

i know that i can exclude an event id by placing a '-' in front of it. But i do not think it works the same way with the User field. If i enter "-MSA" into the "Users" field in Log Subscription it seems like the logs stop sending all together.

↧

Changing Kiwi Syslog web port

August 19, 2016, 6:11 pm
$
0
0

Hi all,

 

Can anyone point me in the direction some documentation on how to change the default Kiwi Syslog web port from 8088 to something else? Say 80?

 

I had a 'quick' search and couldn't find anything solid to go off.

 

Thanks!

↧

Kiwi Syslog Server v9.6.0/9.6.1 need ".NET Framework 4.0" ?

June 14, 2017, 10:04 pm
$
0
0

I tried to install v9.6.1 on Windows Server 2008 R2.

I had already installed ".NET Framework 3.5 SP1" on this system.

 

 

When I executed v9.6.1 installer, I got the following message.

----------------------

Kiwi Syslog Server 9.6.1 Installer

Microsoft .Net Framework 4.0 is not installed on this system

[OK]

----------------------

961_installer_.Net Framework 4.0 is not installed.png

 

I can not install v9.6.1.

I got the same message, when I tried to install v9.6.0.

 

SolarWinds discribed the System Requirements as below:

NET Framework: .NET Framework 3.5 SP1

 

http://www.kiwisyslog.com/kiwi-syslog-server

https://support.solarwinds.com/Success_Center/Kiwi_Syslog_Server/Kiwi_Syslog_Server_Installation_Guide/020_System_requirements_for_Kiwi_Syslog_Server

http://www.solarwinds.com/ja/kiwi-syslog-server#requirements

 

2017-0615_KSS_SystemRequirements_2.png

 

 

Question:

Do Kiwi Syslog Server v9.6.0/9.6.1 need  ".NET Framework 4.0" or Higher?

 

 

Best Regards,

↧

Kiwi Syslog Forwarder windows 2008R2 Invalid Subscription

January 10, 2014, 7:40 am
$
0
0

I am setting up the Kiwi Log Forwarder for windows 2008R2 If i select all the logs ( the logical thing to do in my opinion) I get an "Invalid Subscription error" 1-10-2014 9-38-40 AM.jpg

What is the fix for this as 23 event logs does not cover the list of secondary logs in windows 2008R2

Thank you

↧
↧

Administrator Password Missed; Other way to login

April 17, 2015, 2:56 am
$
0
0

Hi,

 

I have recently been handed over Kiwi Syslog server to manage which has both Fat Client and Web Server. Fat Client is directly logged in however Web console could not be logged in. When I checked regarding the password of "Administrator", I have been informed that resource handling it has left long ago and there is no one to tell.

 

Is there a way we can reset the password of Administrator or create a new user from Syslog Fat Client. I cant raise the request with Support as we do not have active maintanence.

 

Thanks,

Syed

↧

unity400f syslog configuration

April 17, 2017, 12:04 pm
$
0
0

Hi everyone,

 

please let me know how to configure unity device in kiwi syslog web access

 

Thanks in advance

↧
Search

Maximum number of TCP connections has been reached. Not accepting connection.

July 9, 2014, 7:38 am
$
0
0

KiWi Syslogd error: Maximum number of TCP connections has been reached. Not accepting connection.

Why? Thanks..

↧

Sending events from Cisco 3750 switch

January 19, 2011, 8:13 am
$
0
0

Hello,

I am trying to send events from a Cisco 3750 switch to our Kiwi syslog server but am unsure of the config for the switch.

Should the following work:

Switch (config) # logging on
Switch (config) # logging Syslog Server IP
Switch (config) # logging trap error

This command will send (Error 3) events (0-3) to the Kiwi server via UDP514. Is this the supported method of transfer?

Should this work or is there a "Supported" switch configuration that I should be using.

Thank you,

Chris

↧
↧

sys log server errors "FormatMessage failed with 1815" help please!!

April 8, 2015, 2:19 pm
$
0
0

Good day Community,

 

I am experiencing an urgent issue. The sys log server forwarder is forwarding the following message to the KIWI sys log server. The actual security logs are showing the correct information, however the message below is being showed. I thought it was the server, but wen I added another sever to forward security logs, I am getting the same message as shown below.

 

Can anyone who have encountered this message or know how to resolve this issue. The security logs are on the server and I can view them using event viewer properly and audit logs are reflecting fine.

 

I would really appreciate your humble assistance or comments.

 

 

 

Apr 08 14:36:34 CASSIOPEIA1.carimed.local MSWinEventLog 5 Security 495 Wed Apr 08 14:36:33 2015

4624 Microsoft-Windows-Security-Auditing N/A Audit Success CASSIOPEIA1.carimed.local 12544

The description for Event ID 4624 from source Microsoft-Windows-Security-Auditing cannot be

found. Either the component that raises this event is not installed on your local computer or

the installation is corrupted. You can install or repair the component on the local computer.If

the event originated on another computer, the display information had to be saved with the

event.The following information was included with the event: S-1-0-0. FormatMessage failed with

error 1815, The specified resource language ID cannot be found in the image file.

↧

no log shows on Kiwi Syslog Web Access

August 25, 2015, 11:44 am
$
0
0

I am having kiwi syslog 9.5 installed.

I choose to install as service and also installed the web access.

The syslog console opened fine and I see logs on displayed and also to file.

However, with the web access, it shows nothing (what so ever).  I checked the Setup on Console Manager and see that under Rules i have 2 exact same option for "Log to Syslog Web Access".  Everything under that options checked.

But I still see no log on web access.

 

1) I tried to uncheck all the "Log to Syslog Web Access".

2) Closed the Console Manager and reopened it

3) Checked mark one of the 2 optioins "Log to Syslog Web Access" and everything below it.

4) Opened and log in to web access -> Still see nothing.

 

any idea?

↧

how to setup snort-log link to syslog server?

April 24, 2017, 12:31 pm
$
0
0

how to setup snort-log link to syslog server?

 

in snort.conf  (windows 7 32 bits)

output alert_syslog: host=127.0.0.1:8080, LOG_AUTH LOG_ALERT

 

command :

snort -i 1 -c c:\snort\etc\snort.conf -s

 

then get a file in c:\snort\log\snort.log.1493058792.

 

please tell me, how to send log to syslog server?

 

thank you

↧
Viewing all 15803 articles
Browse latest View live
Search
<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>