I wonder if Kiwi Syslog Server has any limitation on how many servers that it can collect the logs from or how many servers can send the logs to the syslog server?

I know the Web Access has 4GB db limitation. What is the best practice for this limitation when you have more than 10 servers sending the logs to syslog server? I don't want to see only 1 or 2 day logs every day from Web Access. I hope at least 4GB db limitation can store like a month logs of all 10+ servers. I am trying first with the windows event logs (using the free tool Solwarwinds Event Log Forwarder)

Is there any limitation that i should be aware with Kiwi Syslog Server and Event Forwarder tool?

Another question:

Does Solarwinds Event Log Forwarder can work with other vendor syslog server? If so, which vendor and which syslog server product is that?

Thanks in advance!

↧

Kiwi Message Buffer

May 22, 2014, 1:18 am

≫ Next: Kiwi Syslog Server Log Location won't change.

≪ Previous: Kiwi Syslog Server limitations

We have two syslog servers and use a F5 to load balance between the two. In total they receive around 45 million messages a day.We have around a dozen rules that forward messages onto a security appliance or splunk and it can take around 30 minutes before those messages arrive. It can also take 30 minutes for any emails to end up in a users mailbox.

As soon as we start the syslog service the message count on the buffer starts to climb and eventually the overflow queue increase. We haven't checked the stats for a while but one of the servers had a overflow queue count of 125,000! It is a VM server running Windows 2003, 2 CPU's and 4Gb RAM.

Here are the stats from the first hour of starting the syslog service

Kiwi Syslog Server [Licensed] Version 9.4.1

/// Kiwi Syslog Server Statistics ///

---------------------------------------------------

24 hour period ending on: Thu, 22 May 2014 09:03:09

Syslog Server started on: Thu, 22 May 2014 08:04:17

Syslog Server uptime: 0 hours, 58 minutes

---------------------------------------------------

+ Messages received - Total: 767628

+ Messages received - Last 24 hours: 767628

+ Messages received - Since Midnight: 767628

+ Messages received - Last hour: 0

+ Message queue overflow - Last hour: 0

+ Messages received - This hour: 767628

+ Message queue overflow - This hour: 0

+ Messages per hour - Average: 767628

+ Messages forwarded: 775368

+ Messages logged to disk: 767587

+ Errors - Logging to disk: 0

+ Errors - Invalid priority tag: 0

+ Errors - No priority tag: 602

+ Errors - Oversize message: 464

+ Disk space remaining on drive C: 3904 MB

Breakdown of Syslog messages by severity

+--------------------+------------+------------+

| Message Level | Messages | Percentage |

+--------------------+------------+------------+

| 0 - Emerg | 17 | 0.00% |

| 1 - Alert | 10 | 0.00% |

| 2 - Critical | 504 | 0.07% |

| 3 - Error | 26356 | 3.43% |

| 4 - Warning | 619384 | 80.69% |

| 5 - Notice | 61780 | 8.05% |

| 6 - Info | 58963 | 7.68% |

| 7 - Debug | 614 | 0.08% |

+--------------------+------------+------------+

Message Buffer Information

==========================

Message Queue Max Size: 500000

Message Queue overflow: 18858

Message Count: 500000

Message Count Max: 500000

Percentage free: 0

Any help would be appreciated

Thanks

John

↧

Kiwi Syslog Server Log Location won't change.

September 17, 2012, 10:44 am

≫ Next: Kiwi Syslog not receiving SNMP Traps

≪ Previous: Kiwi Message Buffer

Hey all,

I have recently taken over a sys admin position, and am required to move the location of the Kiwi Syslog Server logs to another file location. I have never used it prior. However, I can't seem to move the file.

Kiwi Syslog Server 9.2.1 (Free version.)

Windows Server 2003 SP2 (WORKGROUP)(VM)

Current configuration:

Log to Log File

Path and file name: C:\Program Files\Syslogd\Logs\SyslogCatchAll.txt

If I test the configuration, I can see the test messages in the location noted about. However, after I apply the settings, the older location (a CIFS share) continues to receive the actual syslogs of the devices we monitor.

There are three local users, all of which show the same configuration.

I have tried deleting and recreating the Log to Log File rule. No change.

I have tried starting and stopping the service. No change.

I have tried exporting the system settings, and then reimporting them. No change.

I have tried searching the registery for the old location. Nothing found.

I have two theories.

1. The settings are locked for some reason.

2. The settings are stored somewhere else.

Any help would be great.

Thanks,

Aaron

Solarwinds Padawan

↧

Kiwi Syslog not receiving SNMP Traps

September 10, 2015, 6:14 am

≫ Next: Unable to bind secure TCP listener to port 6514 There might be a problem with the certificate provided

≪ Previous: Kiwi Syslog Server Log Location won't change.

Hi all.

I have just installed Kiwi Syslog Server 9.5 on a test machine to evaluate its suitability for a project I'm working on. It's currently still running in 14-day Evaluation mode.

We can't seem to get it to receive SNMP traps at all. No matter what we do, netstat shows nothing listening on UDP port 162. SNMPv1 traps are being sent to the server, and we can see them in Wireshark arriving at the server, but Kiwi isn't listening for them.

In desparation, we tried enabling the Windows SNMP Trap service (although we understand this isn't required?) and this 'absorbed' the traps, but nothing appeared in Kiwi.

The test machine is running Windows 7 (32-bit) with the Windows Firewall switched off.

Should the 14-day Evaluation be able to receive SNMP traps?

Thanks in advance for any advice!

↧

Unable to bind secure TCP listener to port 6514 There might be a problem with the certificate provided

September 25, 2015, 11:27 am

≫ Next: kiwi syslog 9.5 database

≪ Previous: Kiwi Syslog not receiving SNMP Traps

I set up Secure TCP port 6514 in in Kiwi Syslog Server version 9.5.0.332.

I'm getting the following error :

Unable to bind secure TCP listener to port 6514 There might be a problem with the certificate provided

I'm using a self-signed certificate that I created in IIS.

Why doesn't the error message tell exactly what is wrong with the certificate?

Could somebody suggest a solution or a workaround?

Thanks!

↧

kiwi syslog 9.5 database

January 7, 2017, 12:00 pm

≫ Next: Archive schedule task failure

≪ Previous: Unable to bind secure TCP listener to port 6514 There might be a problem with the certificate provided

I just installed kiwi syslog 9.5, I would like to have log actions to a sql database. I have created the table but the syslog server won't log the traffic to the database,when I click the test button the syslogd service stops. It does this every time, how do I make this syslog server log to the database?

↧

Archive schedule task failure

September 15, 2009, 8:36 am

≫ Next: Kiwi Syslog Service Keeps crashing

≪ Previous: kiwi syslog 9.5 database

Using Syslog Service Manager Version 9.0.3 I am trying to archive the logs on an hourly basis. When I test the schedule with the run now it errors with: Task engine aborted with error: Problem copying file [Syslogd_Taskengine.exe 2.5.148] (45600) Main () Win32 file rename failed [Line: 0]

↧

Kiwi Syslog Service Keeps crashing

March 19, 2010, 11:05 am

≫ Next: TCP Syslog Does Not Work in Latest Version

≪ Previous: Archive schedule task failure

We have been experiencing an issue with our Kiwi Syslog Service crashing about every other day. We are running version 9 and have a pretty standard setup where we are pushing syslogs from all of our devices in our network. We have quite a bit of stuff logging to our Syslog server and are easily breaching the 200000 maximum message count throughout the day and getting email's. We up'ed that and seem to be doing better however the syslog service continues to fail and will at times restart itself based off of the services recovery failure to restart the service but this is happening way to often.

Has anyone else seen this problem and if so, what kinds of things did you try/do? Is this box just getting pegged so hard that it's causing the service to malfunction and trip up? I'm not a Windows guy but is this issue even Windows related? The only other application we have running on this server is CatTools and it runs clean with no service issues. The systems team has taken a look at the server and believe this to be related only to the Kiwi application itself.

Next Steps: I'm thinking of removing and rebuilding the Kiwi 9 application from scratch to see if this corrects the issue but wanted some direction from the forum if anyone has any good ideas/suggestions.

Thankyou in advance!

↧

TCP Syslog Does Not Work in Latest Version

March 8, 2018, 1:07 pm

≫ Next: How to export Kiwi syslogs

≪ Previous: Kiwi Syslog Service Keeps crashing

I use kiwi syslog server a lot for testing syslog. It seems like in the latest version there are issues with TCP. I'm verifying with the Kiwi Syslog Message Generator. Seems like with syslog server version 9.4.1 TCP connects and works, but in latest version 9.6.3 it does not connect for some reason. When I try to connect TCP with message generator it says "TCP session remotely disconnected" using the same tool the same exact way, it works with version 9.4.1. I'm using the syslog message generator tool on the same machine as the syslog server. Is this a known issue, or am I missing something? Any suggestions or help would be much appreciated. Thank you very much.

↧

How to export Kiwi syslogs

November 1, 2012, 12:40 pm

≫ Next: Adding devices to the Kiwi Syslog free version

≪ Previous: TCP Syslog Does Not Work in Latest Version

Is there any way for me to export Kiwi Syslogs. I want to be able to export the syslogs from a licensed Kiwi server into another database for viewing. Specifically the NPM database. I would think that there would have been something to do this already since both are SolarWinds products, but I am unable to find it.
I want to be able to take the logs off the Kiwi server and view them elsewhere, without viewing through Kiwi. I want to view them through NPM, but I guess I can get by viewing them through something like Access. Is there a way (even if it isn't easy) to do this?

↧

Adding devices to the Kiwi Syslog free version

October 16, 2014, 3:46 pm

≫ Next: Kiwi Syslog not receiving any message

≪ Previous: How to export Kiwi syslogs

Prior to receiving syslogs from the 5 devices (this is the limit in the free version) they will need to added under Setup\Inputs section. See below:

Image may be NSFW.
Clik here to view.

↧

Kiwi Syslog not receiving any message

October 2, 2014, 5:44 am

≫ Next: Kiwi syslog services restarts

≪ Previous: Adding devices to the Kiwi Syslog free version

Hello,

I just installed Syslog on a Windows 8 VM (ESXi 5.5).

However... I don't received any message from the router (Cisco RV042G) I want to log.

I tried the generic troubleshhoting :

• Check network connectivity by pinging from the sending device to the Syslog Server machine => OK
• Check only one instance of Kiwi Syslog Server is running (Ctrl-Shift-Esc to get the task-list) => OK, only one
• Disable any personal firewall software such as ZoneAlarm or BlackIce => Disabled

• Use a sniffer to check if messages from the routing are reaching the PC => Yes, I can see them
• Check DNS resolution is working as expected by pinging a hostname from the Command Prompt => OK
• Check that there is a "Display" action setup for the facility and level you are expecting to receive messages on. => OK
• Send a test message to yourself by pressing Ctrl+T => Displayed
• Download a copy of the Free Syslog Server Message Generator (SyslogGen) from: www.kiwisyslog.com/downloads => Done
• Install SyslogGen and set it to send a message every second to the address 127.0.0.1 (local host). => Not displayed, and I don't see them in a local packet capture.
• Try sending messages with SyslogGen from another machine to the host running the Syslog Server => Not displayed, but see them on a packet capture (on Syslog PC)

Do you have any idea about the cause of this issue ?

Thanks in advance for your help.

↧

Kiwi syslog services restarts

July 23, 2018, 2:44 am

≫ Next: Kiwi Syslog "Check for update..." error

≪ Previous: Kiwi Syslog not receiving any message

Hi,

Every now and then the services in Kiwi Syslog stops and I have to restart it all the time.. how to solve this

Regards

Moiz

Message was edited by: Moizur Rahman

Image may be NSFW.
Clik here to view.

↧

Kiwi Syslog "Check for update..." error

August 29, 2017, 12:29 pm

≫ Next: 'How much traffic can Kiwi Syslog Server handle?'

≪ Previous: Kiwi syslog services restarts

We are new to Kiwi Syslog and are just getting things configured. We are on version 9.6.1.6. One thing I immediately noticed is that running the "Check for update..." results in the following error: "An error occurred while checking for available software updates. Check internet connectivity or proxy server settings.".

We have no proxy server enabled. From the server with Kiwi Syslog, I have Internet connectivity via a browser with no problems.

From Kiwi's error log, I see the following line associated with the failed update: "Info: An error occurred while checking for available software updates. Moved Temporarily [20152] - Resource: http://downloads.solarwinds.com/solarwinds/Release/Kiwi/Syslog/currentkiwisyslogversion.xml". If I paste that URL into a browser, it returns the following:

<?xml version="1.0"?>

-<KiwiSyslogServerVersionManifest Version="1">

<CurrentVersion Version="9.6.1" Link="http://downloads.solarwinds.com/solarwinds/Release/Kiwi/Syslog/Kiwi-Syslog-Server-9.6.1.zip" DateReleased="2017-05-01"> New in 9.6.1 update ------------------------------ * Kiwi Syslog Server no longer creates large SolarWinds.SyslogServer.Engine.log fileswhich consume significant disk space. * Kiwi Syslog Server diagnostic information shows the correct buffer usage for all types of messages * If you do not see a "Download Update" button below, copy and paste the following link into your browser to download: http://downloads.solarwinds.com/solarwinds/Release/Kiwi/Syslog/Kiwi-Syslog-Server-9.6.1.zip</CurrentVersion>

</KiwiSyslogServerVersionManifest>

I can then paste the .zip link it references into a browser and get the zip file to download (although it appears to be the same version we already have).

Has anyone experienced the same issue or know how to fix it?

Thanks!

↧

'How much traffic can Kiwi Syslog Server handle?'

January 3, 2016, 8:13 pm

≫ Next: Kiwi 9.6 and forwarding SNMP traps as Syslogs

≪ Previous: Kiwi Syslog "Check for update..." error

according to the FAQ.. Our software is built and tested to support more than two million messages an hour without tuning. (That would support more than 500 machines each sending one message a second.)

This blog says to split out your busiest syslog source...

How many messages can Kiwi Syslog manage?

But what do you do when a single source exceeds 600-1000 messages per second? eg., upstream syslog aggregator or firewalls

↧

Kiwi 9.6 and forwarding SNMP traps as Syslogs

March 4, 2017, 6:46 am

≫ Next: Forward Event Viewer subscriptions with Event Log Forwarder for Windows

≪ Previous: 'How much traffic can Kiwi Syslog Server handle?'

9.6 release notes....

"SNMP traps are now forwarded without changes. In previous versions, the SNMP trap was converted to a string and forwarded as a syslog messages, which could result in MAC addresses being displayed incorrectly."

I considered this conversion a feature, one that I need to pipe data into a system that can't receive traps. Is this a setting in which I can choose how it gets forwarded (snmp/syslog)? This conversion feature was a deciding factor in my Kiwi purchase last week.

Thank you.

↧

Forward Event Viewer subscriptions with Event Log Forwarder for Windows

March 8, 2017, 1:45 pm

≫ Next: Monitor Syslog

≪ Previous: Kiwi 9.6 and forwarding SNMP traps as Syslogs

Has anyone been able to forward subscribed events (from other machines) to Kiwi Syslog server using Event Log Forwarder for Windows? I am trying to setup a single point to collect events to be forwarded to our syslog server.

I setup a test and subscribed to events from another machine to be placed in the Windows Logs -> Application. I see the forwarded events in Windows Event Viewer, but when viewing the "preview of matching event records" (Event Log Forwarder for Windows) I only see the events sources from the computer running the event log forwarder. (see the attached screenshot)

Thanks!

Jeremy

↧

Monitor Syslog

July 4, 2018, 3:14 am

≫ Next: Syslog solution (New*) Log Manager for Orion or (old)Kiwi Syslog.

≪ Previous: Forward Event Viewer subscriptions with Event Log Forwarder for Windows

I want to know how to monitor kiwi syslog & by which port????

↧

Syslog solution (New*) Log Manager for Orion or (old)Kiwi Syslog.

July 9, 2018, 12:12 am

≫ Next: Kiwi Syslog Server registry entry is insecure

≪ Previous: Monitor Syslog

Dear Thwack experts,

Our WAN is spread across 500 sites, connected via 5 Datacenters, Most are VPN connections btw Sites and DC's ,but few still have slow paced connections.

For NPM, We are planning to build our HA solution across DC1 and DC2, and will use APE at DC3,DC4 & Dc5, So that each polling engine can poll the devices at connected remote site.

Now speaking about Syslog monitoring Requirement, We felt Log manager for Orion has lot more feature , But may not fit into our environment.

Discussion points:

-In our case, Device at remote site, need to send syslog message to the centralized solution

1)Kiwi have below solution:
Kiwi Secure Tunnel receives, compresses, and securely transports, syslog messages from distributed network devices to the Kiwi Syslog Daemon.

Image may be NSFW.
Clik here to view.

Does Log manager for Orion can be used here.??

2) Kiwi also store the syslog and trap messages into Microsoft® SQL Server , Apart from Log tagging, how different can Log manager can help to our operations team,, any comparison between KIWI and LM would be more helpful

( please correct me, if I am wrong some where)

↧