Kiwi Syslog not displaying Cisco ASA 5505 syslogs

April 2, 2011, 7:21 pm

≫ Next: Kiwi Syslog "Check for update..." error

≪ Previous: SolarWinds Event Log Forwarder for Windows

$

0

0

I have a Cisco ASA 5505 that is setup to send syslogs to a remote syslog server.

I have kiwi syslog (free) installed on a Windows 2003 R2 Server and it is listening on UDP port 514. The syslog server also is my Ciscoworks v3.2 server.

I can ONLY see the Ciscoworks log files and not the ASA. I only want to display the ASA log files.

I have googled, read the user guide, and search the forum and cannot find any procedure that I can tweak Kiwi to log the syslog files from my ASA which is being used as a VPN concentrator.

Any ideas?

---

Kiwi Syslog "Check for update..." error

August 29, 2017, 12:29 pm

≫ Next: Does Kiwi syslog server support TLS 1.2? If so how to enable it?

≪ Previous: Kiwi Syslog not displaying Cisco ASA 5505 syslogs

$

0

0

We are new to Kiwi Syslog and are just getting things configured.  We are on version 9.6.1.6.  One thing I immediately noticed is that running the "Check for update..." results in the following error: "An error occurred while checking for available software updates.  Check internet connectivity or proxy server settings.". 

 

We have no proxy server enabled.  From the server with Kiwi Syslog, I have Internet connectivity via a browser with no problems. 

 

From Kiwi's error log, I see the following line associated with the failed update: "Info: An error occurred while checking for available software updates.  Moved Temporarily [20152] - Resource: http://downloads.solarwinds.com/solarwinds/Release/Kiwi/Syslog/currentkiwisyslogversion.xml".  If I paste that URL into a browser, it returns the following:

 

<?xml version="1.0"?>

-<KiwiSyslogServerVersionManifest Version="1">

<CurrentVersion Version="9.6.1" Link="http://downloads.solarwinds.com/solarwinds/Release/Kiwi/Syslog/Kiwi-Syslog-Server-9.6.1.zip" DateReleased="2017-05-01"> New in 9.6.1 update ------------------------------ * Kiwi Syslog Server no longer creates large SolarWinds.SyslogServer.Engine.log fileswhich consume significant disk space. * Kiwi Syslog Server diagnostic information shows the correct buffer usage for all types of messages * If you do not see a "Download Update" button below, copy and paste the following link into your browser to download: http://downloads.solarwinds.com/solarwinds/Release/Kiwi/Syslog/Kiwi-Syslog-Server-9.6.1.zip</CurrentVersion>

</KiwiSyslogServerVersionManifest>

 

I can then paste the .zip link it references into a browser and get the zip file to download (although it appears to be the same version we already have). 

 

Has anyone experienced the same issue or know how to fix it?

 

Thanks!

Does Kiwi syslog server support TLS 1.2? If so how to enable it?

August 21, 2015, 6:46 am

≫ Next: Kiwi Syslog Server does not display secure ASA syslogs

≪ Previous: Kiwi Syslog "Check for update..." error

$

0

0

I am trying to connect to kiwi syslog server in secure TCP mode. From my client side (c# code) I try to connect to kiwi syslog sever using TLS 1.2 protocol. But SSL Handshake from server is set to TLS 1.0

I installed kiwi server in Windows 7 SP1 and enabled TLS 1.2 in the system by modifying the system registry.

 

SSL handshakes captured using Network monitor are given below

 

Client HandShake

 

 

Server HandShake

 

Client side code( c#)

 

System.Net.ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls12;

var tcpClient = new TcpClient(hostname, port);

var tcpClientStream = tcpClient.GetStream();

var sslStream = new SslStream(tcpClientStream, false, ValidateServerCertificate)

{

        ReadTimeout = timeout,

        WriteTimeout = timeout

};

sslStream.AuthenticateAsClient(hostname, new X509CertificateCollection(), System.Security.Authentication.SslProtocols.Tls12, false);

Kiwi Syslog Server does not display secure ASA syslogs

June 9, 2015, 1:32 am

≫ Next: How to backup Kiwi Syslog Server?

≪ Previous: Does Kiwi syslog server support TLS 1.2? If so how to enable it?

$

0

0

Hello to the community!

I have been confused with this for a while and i would like to get your help!

 

I have a network topology with an ASA 5520 and a Kiwi Syslog server 9.3.4-eval. I also have a CA server.

I have installed the root CA certificate on both the Kiwi Syslog Server and the ASA.

Also i have generated a certificate request for the Kiwi server which was signed by the CA server and also made a trustpoint on the ASA with that certificate (The signed one)

 

When i try to send syslogs it doesn't display anything.

 

I have installed Kiwi SyslogGen and have made some tests.

When i make a test with destination port 1468 (TCP default) it works and displays something on the Kiwi manager.

But when i make a test with destination port 6514 (Default Secure TCP) it fails.

 

On the command prompt i issued the following:

netstat -ano

there were the following entries regarding syslog:

TCP: 0.0.0.0 1468

UDP: 0.0.0.0:514

 

But nothing is listening to 6514

What can be the problem? Thank you very much in advance!!

 

Somethin i saw on the error log:

Unable to bind TCP listener to port 6514 There might be a problem with the certificate provided.

Here are some pictures of the settings:

 

How to backup Kiwi Syslog Server?

March 18, 2016, 2:03 am

≫ Next: syslog server service will not stay running

≪ Previous: Kiwi Syslog Server does not display secure ASA syslogs

$

0

0

Dear all,

 

I would like to know how to backup a Kiwi Syslog Server.  We are installing this in VM, but the environment only has NetBackup.

 

I know that I can export the data out as log file for backup, but how about backup when log are still in the Kiwi Syslog Server database?

 

I am not able to find any reference in the Admin guide.

 

Best Regards,

Rayson Wong

syslog server service will not stay running

February 17, 2017, 2:42 pm

≫ Next: SolarWinds.SyslogServer.Engine.log

≪ Previous: How to backup Kiwi Syslog Server?

$

0

0

I had this the syslog server on a 2003 box - moved to 2012 R2 and the service will not stay running - anyone have any ideas or have run into this issue?

SolarWinds.SyslogServer.Engine.log

April 6, 2017, 11:52 am

≫ Next: How to Migrate Kiwi Syslog server and viewer to Another system

≪ Previous: syslog server service will not stay running

$

0

0

Hi, I was hoping someone can explain the log files ('SolarWinds.SyslogServer.Engine.log') created in the Syslogd folder to me. What purpose do they serve? Are they safe to delete? Can I set them to be created in a different directory?

 

Thank you.

How to Migrate Kiwi Syslog server and viewer to Another system

April 28, 2010, 12:15 am

≫ Next: How to deactivate kiwi syslog server licence without the licence manager

≪ Previous: SolarWinds.SyslogServer.Engine.log

$

0

0

Current system on which Kiwi Syslog Server and viewer are installed is not working properly and we need to migrate to another system,
And SolarWinds License Manager does not reset Kiwi, ipMonitor, or LANsurveyor product licenses.

Kindly Solve the issue.

 

Thanks

Imran

---

How to deactivate kiwi syslog server licence without the licence manager

July 15, 2013, 4:52 am

≫ Next: Kiwi Syslog Server limitations

≪ Previous: How to Migrate Kiwi Syslog server and viewer to Another system

$

0

0

Hello,

 

I have an issue with the migration of my kiwi syslog product.

 

I have got a new server and I want to migrate my kiwi syslog version on this new server (after deactivating it on the old one).

 

When I read the documentation it is said to install the licence manager tool.

But when I use it, the tool says "No licensed solarwinds products on your machine".

 

But my two products are well registered and I can see the licenses on my online account.

 

Is it possible to deactivate them manually ?

 

Thanks for your helpsyslog

Kiwi Syslog Server limitations

July 28, 2017, 9:00 am

≫ Next: Kiwy syslog "Service running, but Service/Manager comm link is not connecting" on a virtual machine

≪ Previous: How to deactivate kiwi syslog server licence without the licence manager

$

0

0

Hi everyone,

 

I wonder if Kiwi Syslog Server has any limitation on how many servers that it can collect the logs from or how many servers can send the logs to the syslog server?

 

I know the Web Access has 4GB db limitation.  What is the best practice for this limitation when you have more than 10 servers sending the logs to syslog server? I don't want to see only 1 or 2 day logs every day from Web Access.  I hope at least 4GB db limitation can store like a month logs of all 10+ servers.  I am trying first with the windows event logs (using the free tool Solwarwinds Event Log Forwarder)

 

Is there any limitation that i should be aware with Kiwi Syslog Server and Event Forwarder tool?

 

Another question:

Does Solarwinds Event Log Forwarder can work with other vendor syslog server? If so, which vendor and which syslog server product is that?

 

Thanks in advance!

Kiwy syslog "Service running, but Service/Manager comm link is not connecting" on a virtual machine

March 14, 2017, 2:14 am

≫ Next: How to export Kiwi syslogs

≪ Previous: Kiwi Syslog Server limitations

$

0

0

Hi eveyone

 

I have a problem with my syslog server, it send he following messages:

 

Service running, but Service/Manager comm link is not connecting.

Unable to connect to Service socket on TCP port 3300

 

The server is installed on a windows 7 virtual machine on an vmware enviroment, I already verified the TCP port  and it belongs to the syslog server, also the windows firewall is down

 

Do you have any ideas?

 

Regards

How to export Kiwi syslogs

November 1, 2012, 12:40 pm

≫ Next: no log shows on Kiwi Syslog Web Access

≪ Previous: Kiwy syslog "Service running, but Service/Manager comm link is not connecting" on a virtual machine

$

0

0

Is there any way for me to export Kiwi Syslogs.  I want to be able to export the syslogs from a licensed Kiwi server into another database for viewing.  Specifically the NPM database.  I would think that there would have been something to do this already since both are SolarWinds products, but I am unable to find it.
  I want to be able to take the logs off the Kiwi server and view them elsewhere, without viewing through Kiwi.  I want to view them through NPM, but I guess I can get by viewing them through something like Access.  Is there a way (even if it isn't easy) to do this?

no log shows on Kiwi Syslog Web Access

August 25, 2015, 11:44 am

≫ Next: Kiwi Syslog Service hanging

≪ Previous: How to export Kiwi syslogs

$

0

0

I am having kiwi syslog 9.5 installed.

I choose to install as service and also installed the web access.

The syslog console opened fine and I see logs on displayed and also to file.

However, with the web access, it shows nothing (what so ever).  I checked the Setup on Console Manager and see that under Rules i have 2 exact same option for "Log to Syslog Web Access".  Everything under that options checked.

But I still see no log on web access.

 

1) I tried to uncheck all the "Log to Syslog Web Access".

2) Closed the Console Manager and reopened it

3) Checked mark one of the 2 optioins "Log to Syslog Web Access" and everything below it.

4) Opened and log in to web access -> Still see nothing.

 

any idea?

Kiwi Syslog Service hanging

May 26, 2017, 11:45 am

≫ Next: Event Log Forwarder - Where is the Audit Failure Type?

≪ Previous: no log shows on Kiwi Syslog Web Access

$

0

0

1st time starting a discussion.

1st time working with Kiwi Syslog.

Let me know if I'm in the wrong place.

 

I am very new to Syslog Servers.

I'm a Route/Switch type guy.

 

We are using Kiwi Syslog to get Call Manager Call Traces for troubleshooting.

This Instance of Kiwi Syslog was working fine as a Guest VMware Server on a Host Server.

We used the app Veeam to move the Kiwi Syslog VMware Guest Server to another Host.

This issue started after the copy/move of the Kiwi Syslog

 

No IP addresses were changed, it's on the same network as before.

It starts up, logs are being received, and then they stop.

If you try to start the service, it tells you it's already running.

 

At the bottom of the Kiwi Syslog Service Manager, you can see the MPH indicator has stopped.

Looking at the correct folder I can see the logs are no longer being  received.

If I stop the service and start the service it starts.

There is a script that tells it to restart every morning at 4am, and it will do this.

 

Below is the error event seen when it stopped last time.

 

Windows Server 2012 R2

64 -bit OS

 

Has anyone seen this type of issue before?

 

Any help would be greatly appreciated,

 

Mhaley

Event Log Forwarder - Where is the Audit Failure Type?

March 18, 2015, 5:40 pm

≫ Next: 'How much traffic can Kiwi Syslog Server handle?'

≪ Previous: Kiwi Syslog Service hanging

$

0

0

Hi There,

 

I'm trialing Kiwi Syslog and I'm having trouble with the Log Forwarder and Security Event Log.  When I click on the Security Log I don't see Audit Success or Audit Failure as an event type.  It just has Error, Warning and Information.  If I manually edit the CFG file and add <int>16</int> it works, but then it gets overwritten if I make a change.  Am I doing something wrong?  How can I see Audit Failure as an Event Type?

 

Thanks,

---

'How much traffic can Kiwi Syslog Server handle?'

January 3, 2016, 8:13 pm

≫ Next: Domain Admin login event log forwarding?

≪ Previous: Event Log Forwarder - Where is the Audit Failure Type?

$

0

0

according to the FAQ.. Our software is built and tested to support more than two million messages an hour without tuning.   (That would support more than 500 machines each sending one message a second.)

This blog says to split out your busiest syslog source...

How many messages can Kiwi Syslog manage?

But what do you do when a single source exceeds 600-1000 messages per second? eg., upstream syslog aggregator or firewalls

Domain Admin login event log forwarding?

October 2, 2017, 11:54 am

≫ Next: log forwarder and dhcp auditing?

≪ Previous: 'How much traffic can Kiwi Syslog Server handle?'

$

0

0

Hello,

 

    I'm currently trying to get the logs of where (what IP) and when (date and time) the Domain Administrator account information is used to log into one of three specific machines (2 DC's, and a Finance server). I'm having some trouble defining the subscription in the Kiwi Log Forwarder - Specifically, what boxes do I need to tick off and what event ID number do I need to include? I have the IP's for the three servers that I want AD to send the Admin login logs from. Thanks!

log forwarder and dhcp auditing?

October 15, 2011, 10:57 am

≫ Next: Kiwi Syslog not capturing syslogs

≪ Previous: Domain Admin login event log forwarding?

$

0

0

I am needing to forward all of our DHCP audits to the syslog, however I cannot figure out how to do that with the Log Forwarder.  Which source do I use in the Event Viewer?  The audit is logged to a file.  Is there any way to forward changes to files?

Kiwi Syslog not capturing syslogs

May 14, 2013, 1:40 pm

≫ Next: Forward syslog events to QRadar

≪ Previous: log forwarder and dhcp auditing?

$

0

0

Installed Kiwi Syslog Free version 9.3.4 on Windows Server 2008 R2.  Trying to capture syslog from a Cisco ASA 5510.  I have confirmed that the syslog events are hitting the server with Wireshark.  Nothing is coming through to Kiwi Syslog.  Current settings are all default.  No filters in place.  Not sure what is wrong as I can see the syslog messages coming through Wireshark. Any ideas as to why the syslog messages are not being seen by Kiwi?

Forward syslog events to QRadar

January 13, 2016, 11:55 am

≫ Next: Kiwi syslog web access export all filters

≪ Previous: Kiwi Syslog not capturing syslogs

$

0

0

I'm trying to forward events from Kiwi Syslog to QRadar SIEM. 

 

In Kiwi Syslog setup, I created an Action: Forward to another host; gave it the QRadar appliance's IP as the Destination IP; selected "Retain the original source address of the message"; clicked the Test button to verify the configuration and got a gree checkmark.

 

The test event was the only event received by the QRadar.  None of the events I'm forwarding have been received as incoming logs on QRadar.

 

I've tried this with and without adding the Kiwi Syslog servers as log sources in QRadar.

 

Do I need to install a universal DSM on the Kiwi Syslog servers?