Hi,

I have a problem with python script, my script works fine when I run it outside Kiwi syslog with test data as you can see it in picture below

but when i try to run it inside kiwi syslog i get error as you can see in next pictures

this is the script:

there is very little info on python script usage in kiwi syslog, maybe I'm doing something wrong. Any help would be appreciated.

Thanks in advance.

Good day Community,

I am experiencing an urgent issue. The sys log server forwarder is forwarding the following message to the KIWI sys log server. The actual security logs are showing the correct information, however the message below is being showed. I thought it was the server, but wen I added another sever to forward security logs, I am getting the same message as shown below.

Can anyone who have encountered this message or know how to resolve this issue. The security logs are on the server and I can view them using event viewer properly and audit logs are reflecting fine.

I would really appreciate your humble assistance or comments.

Apr 08 14:36:34 CASSIOPEIA1.carimed.local MSWinEventLog 5 Security 495 Wed Apr 08 14:36:33 2015

4624 Microsoft-Windows-Security-Auditing N/A Audit Success CASSIOPEIA1.carimed.local 12544

The description for Event ID 4624 from source Microsoft-Windows-Security-Auditing cannot be

found. Either the component that raises this event is not installed on your local computer or

the installation is corrupted. You can install or repair the component on the local computer.If

the event originated on another computer, the display information had to be saved with the

event.The following information was included with the event: S-1-0-0. FormatMessage failed with

error 1815, The specified resource language ID cannot be found in the image file.

Hopefully this makes sense. Barracuda has published a script in Perl that demonstrates how to parse the log. The items in the message field are separated by spaces. Barracuda shows the following in their script (the message field has been placed in the $info variable earlier in their scrip):

            if( $info =~ /([^\s]+)\s([^\s]+)\s([^\s]+)\s([-\.\d+]+)\s(\d+)\s(\d+)\s(.*)\sSUBJ:(.*)$/ )

            {

                  ($enc, $sender, $recip, $score, $action, $reason, $reason_extra, $subject) =

                    ($1, $2, $3, $4, $5, $6, $7, $8);

               }

What I would like to do is place these in the Custom variable 1-8. Going through the kiwi example that comes with the syslog server, that part seems relatively easy.

I am brand new to Perl and trying to get this accomplished in the Evaluation window of the Kiwi server to show proof of concept. Is Perl the best way to separate the message based on spaces? Is there a better way to do this? Or does someone have an example of how to do this in Perl or any other language that kiwi supports?

Cheers

Hello, I ran the Kiwi Syslog trial previously with no problems at all on a virtual server running Windows Server 2008 R2 64 bit.  When I came to upgrade it to a registered version, the install failed at the end, at the part where the Kiwi Syslog server gets started. 

The error is: Kiwi Syslog Server Service Installation failed.  The Kiwi Syslog Server Service could not be installed using account.  Please run the installer again and try another user account (eg. LocalSystem or a member of the local Administrators group).

Sometimes the error is: Kiwi Syslog Server Service failed to start.  Please try installing the service again using a member of the Administrators group.

I ran the setup application as administrator, using a domain user account which is in a security group in the local administrators group.  I chose LocalSystem as the account to run it as.

I also tried using the local administrator, with the same results.

If I try to start the service manually, it eventually starts, but takes about 40 or so seconds.  But it doesn't stay up for long.

The Windows Event Viewer doesn't seem to log anything when the service quits.

I had no such problems with the evaluation copy.  Perhaps a clean install is required?  How would I go about doing this?  I've uninstalled, then deleted C:\Program Files (x86)\syslogd, then deleted c:\Program Data\solarwinds and also HKLM\Software\Wow6432Node\SolarWinds.  Have I missed anything?

Thank you.

In order for the syslogs that come from an ISE server you must change the message length to 8192 on the device or the messages will be messed up.

Is there a setting on the KIWI server I need to adjust to accommodate this?

It appears when viewing the logs coming in thru the manager console they look ok, but if you send that to a log file the entries in the file are incomplete or truncated.

Kiwi syslog stopped collecting information. The view error log button is red and blinking. When i click to view the log

is see  the below message repeating itself:

2011-03-18 10:54:01     Licensed action was found in settings and disabled.

2011-03-18 10:54:01     Licensed action was found in settings and disabled.

2011-03-18 13:37:56     Licensed action was found in settings and disabled.

2011-03-18 13:37:57     Licensed action was found in settings and disabled.

2011-03-18 13:37:57     Licensed action was found in settings and disabled.

Does anyone know of a way to import/export rules to/from KiWi Syslog Server via command line or other means?

We have a very heavily utilized LEM with a "farm" of KiWi syslog servers sitting behind a load balancer.  When ever we change the rule on one KiWi server, we need to manually export the rule and import it to the KiWi servers.

We would like to find a way to script this, but we cannot find any relevant CLI options in the admin guide.  If anyone has done this or has a suggestion, it would be greatly appreciated.

If this is not possible, then would anyone find interest in a supporting a feature request to have a centralized management console for large deployments of KiWi syslog servers?

Thanks!

Hi people !

I am testing Kiwi Syslog Server Service edition with Evaluation Version....

I am running Kiwi on a 2008r2 SP1 (R2 is x64).

I am trying to run the Kiwi daemon with the system local account ; but i have the error 1053 poping:

"  The service did not respond to the start or control request in a timely fashion "

I tried to adjust the timeout Value in the Registry to 60 (30 by default) ; no way the kiwi syslog Service don't start.

I created the debugging value to see what happening on startup, but i have only :

2011-11-21 18:50:19    Start-up file Initialized.
2011-11-21 18:50:19    Performing NT Service setup for Kiwi Syslog Server
2011-11-21 18:50:19    Service Starting - NTServiceSetup

--

When i am using the administrator account of the server ; the service starts quickly ...here is the debug log :

2011-11-21 19:03:44    Start-up file Initialized.
2011-11-21 19:03:44    Performing NT Service setup for Kiwi Syslog Server
2011-11-21 19:03:44    Service Starting - NTServiceSetup
2011-11-21 19:03:44    Service startup triggered. Parameters:
2011-11-21 19:03:45    Startup entered
2011-11-21 19:03:45    About to initialise sockets
2011-11-21 19:03:45    Listening on InterApp TCP port 3300
2011-11-21 19:03:45    Listening on UDP port 514
2011-11-21 19:03:46    Message check timer started
2011-11-21 19:03:46    Startup completed

But for security reason i can't use an admin Account, i need to use the local system account.

--

I ran procmon to see what's wrong ; no errors about File/Registry denied access.

When using Local system account, the process stops here :

--

When using an Admin account , the process starts, and "hits" an .INI file (KRDP_Sessions.ini) :

--

Can you have any information on this ?

Regards,

I'm having trouble configuring email alerts. I'm trying to send alerts to my Office 365 email address. Can someone see if I've input one of these settings incorrectly? I'm using my full Office 365 email for each of the blacked out sections in the screen shot below. For "SMTP Password," I'm using my Office 365 password.

Hello,

    I'm currently trying to get the logs of where (what IP) and when (date and time) the Domain Administrator account information is used to log into one of three specific machines (2 DC's, and a Finance server). I'm having some trouble defining the subscription in the Kiwi Log Forwarder - Specifically, what boxes do I need to tick off and what event ID number do I need to include? I have the IP's for the three servers that I want AD to send the Admin login logs from. Thanks!

i have web access enabled, and it is showing logs, just not the current logs.

E:\Program Files\Syslogd\Logs\ is showing txt files for the current date, but what is being displayed in the web console is the oldest file

The service manager is showing live data being captured

how can i get the web access to also show the live data being captured?

Hello,

I have been working in log management for a couple of years now. Across all the clients I've met, kiwi syslog had been in use for quite a while.

From a functionality perspectives, amazing things were achieved with it by operational teams.

But I am no expert at configuring kiwi syslog although somewhat familiar with it.

I am often involved in building centralized log management infrastructure and here where I always get stuck with kiwi syslog.

Perhaps there is a hidden config option that I missed ?

Implementing a centralized log management infrastructure often dictates that all logs (syslog) are to be sent to a single destination, the centralized log management.

This destination is always defined with high performance and high resilience in mind e.g. VIP, load balancers, failover systems

For any other systems that requires access to the logs, a live unmodified copy is forwarded to them.

In other words, we just built a syslog relay chain.

And with as much respect I have for your product, making kiwi syslog the first in that relay chain in a central log management system is not an option.

Nor is double-feeding from the source, building a central log management is all about having a single destination for logs where redistribution is performed there.

Whenever I walk into a department that has been running kiwi syslog for a while, they have implemented a lot of automation with it.

Obviously, they (and I agree) want to keep using it.

So the simplest solution would be to forward logs from the centralized syslog server TO the deparment kiwi syslog server.

This ways the enterprise is happy, centralized log management is in place AND that department is happy, the same interface they are using is still there.

Thats where I hit a snag.

To my knowledge, Kiwi syslog ALWAYS take as the source of the message the IP address even if it receives properly RFC3164 or RFC5424 messages containing hostnames.

Therefore, using kiwi syslog in a relay chain where its not the first one in the relay makes all source the previous IP address.

Yes spoofing can be used in the relay chain, but its not elegant, it slows down throughput quite a lot and more often than not, does get blocked by security guidelines.

Almost all advanced syslog server in the field are configurable and allow to use either the hostname contained in properly formatted syslog messages as the source host.

For improperly formatted messages, then the IP of the connected socket is taken.

Also, with some templating, its even possible in the first relay to add in the message an ORIGINATING IP prefix and get the hostname from there.

On output I saw that rsyslog supports adding such prefix.

My questions are:

1. Is there a way to configure kiwi syslog to take the source from inside the syslog message received because it was prefixed with "originating address=4.4.4.4" for example ?

2. Is there a way to configure kiwi syslog to take the source from the hostname syslog header and if it fails to take it from the connected socket ?

Without a way to do any of the above, Kiwi simply doesn't support being on the receiving end of a syslog relay chain and ends up being discarded where it still had lots of value.

Most large enterprises are really looking at central log management, and message brokers like kafka to store the logs and allow for log distribution.

Feeding specific logs from Kafka to kiwi syslog would be a tremendous help for operational teams but e.g. if all the logs have as a source a single IP address, the Kafka cluster instead of the real IP of their firewall, it makes this forwarding useless.

Presuming that I read the doc and havent missed anything, if rsyslog could support on TCP and UDP input a setting that instruct to look for ORIGINATING ADDRESS inserted it the messatge and use this IP address as the source for display, that would be amazing.

Hoping I overlooked some part of the documentation, otherwise is there anyone else who sees this an extremely important feature to support ?

Hi folks,

I have not gone through any previous threads. Pardon me if this is a repeated query or clarification requested. Have started looking at trial version initially to make sure if this supports my requirements.

Have couple of queries, request to clarify these with request to secure tcp syslog server.

a. Currently seeing that although requested TLS version is set to v1.2 in client hello, Server negotiates back to v1.0. Is there a way to continue with TLSv1.2 protocol.

b. Also have CA signed certificates imported on both to Syslog server running on windows and also on corresponding router acting as a client. But Server doesnt request for Client certificate (as its optional) and unable to verify mutual authentication. Only server certificate is validated by the Client and connection is made. How to enforce mutual authentication where router to validates the client certificate.

c. Is there any IPv6 address support for Syslog server, or its only available in licensed version.

Thanks in advance.

-Gopal

I've got a set of 3 Kiwi servers sitting behind an F5, which I *thought* would effectively load balance the incoming syslog volume (I'm seeing around 5-8million messages per hour, and we haven't really turned everything on yet).

The problem, I just discovered, is that F5 load balances based on connections, not messages/packets. So round robin isn't round robin since most of my sending systems are passing new messages (and therefore creating a connection) more than even the lowest "disconnect after" option on the F5 (which is 1 second).

So my first server is maxing out at about 5million MPH and 0% buffer, while server 02 gets 2million messages and 80% buffer, and server 03 gets barely anything at all.

Has anyone else tried this, and have you found a work around (it doesn't have to be an F5. I just need the ability to create a pool of Kiwi servers and have all the systems in my enterprise sending to ONE ip address.

Thanks!

- Leon

Hello,

I just installed Syslog on a Windows 8 VM (ESXi 5.5).

However... I don't received any message from the router (Cisco RV042G) I want to log.

I tried the generic troubleshhoting :

• Check network connectivity by pinging from the sending device to the Syslog Server machine  => OK
• Check only one instance of Kiwi Syslog Server is running (Ctrl-Shift-Esc to get the task-list) => OK, only one
• Disable any personal firewall software such as ZoneAlarm or BlackIce => Disabled

• Use a sniffer to check if messages from the routing are reaching the PC => Yes, I can see them
• Check DNS resolution is working as expected by pinging a hostname from the Command Prompt => OK
• Check that there is a "Display" action setup for the facility and level you are expecting to receive messages on. => OK
• Send a test message to yourself by pressing Ctrl+T => Displayed
• Download a copy of the Free Syslog Server Message Generator (SyslogGen) from: www.kiwisyslog.com/downloads => Done
• Install SyslogGen and set it to send a message every second to the address 127.0.0.1 (local host). => Not displayed, and I don't see them in a local packet capture.
• Try sending messages with SyslogGen from another machine to the host running the Syslog Server => Not displayed, but see them on a packet capture (on Syslog PC)

Do you have any idea about the cause of this issue ?

Thanks in advance for your help.

Hi guys

I'm new on this forum and I need your help , I'm using Kiwi syslog server version 9.6.5 , I create a lot of rules for group of the equipments  that  feed my syslog server(switch, servers , firewall..), and I have different stakeholders to whom I have to give access through Kiwi syslog web acces but I want to restrict access to the context that everyone have to had access !without giving access to all logs.

When we create users account  on the console , there is no way to personalize profil to do that.

My question there is a way to do that?

Thanks

Hopefully this makes sense. Barracuda has published a script in Perl that demonstrates how to parse the log. The items in the message field are separated by spaces. Barracuda shows the following in their script (the message field has been placed in the $info variable earlier in their scrip):

            if( $info =~ /([^\s]+)\s([^\s]+)\s([^\s]+)\s([-\.\d+]+)\s(\d+)\s(\d+)\s(.*)\sSUBJ:(.*)$/ )

            {

                  ($enc, $sender, $recip, $score, $action, $reason, $reason_extra, $subject) =

                    ($1, $2, $3, $4, $5, $6, $7, $8);

               }

What I would like to do is place these in the Custom variable 1-8. Going through the kiwi example that comes with the syslog server, that part seems relatively easy.

I am brand new to Perl and trying to get this accomplished in the Evaluation window of the Kiwi server to show proof of concept. Is Perl the best way to separate the message based on spaces? Is there a better way to do this? Or does someone have an example of how to do this in Perl or any other language that kiwi supports?

Cheers

I'm trying to forward events from Kiwi Syslog to QRadar SIEM. 

In Kiwi Syslog setup, I created an Action: Forward to another host; gave it the QRadar appliance's IP as the Destination IP; selected "Retain the original source address of the message"; clicked the Test button to verify the configuration and got a gree checkmark.

The test event was the only event received by the QRadar.  None of the events I'm forwarding have been received as incoming logs on QRadar.

I've tried this with and without adding the Kiwi Syslog servers as log sources in QRadar.

Do I need to install a universal DSM on the Kiwi Syslog servers?

Has anyone been able to forward subscribed events (from other machines) to Kiwi Syslog server using Event Log Forwarder for Windows? I am trying to setup a single point to collect events to be forwarded to our syslog server.

I setup a test and subscribed to events from another machine to be placed in the Windows Logs -> Application. I see the forwarded events in Windows Event Viewer, but when viewing the "preview of matching event records" (Event Log Forwarder for Windows) I only see the events sources from the computer running the event log forwarder. (see the attached screenshot)

Thanks!

Jeremy

1st time starting a discussion.

1st time working with Kiwi Syslog.

Let me know if I'm in the wrong place.

I am very new to Syslog Servers.

I'm a Route/Switch type guy.

We are using Kiwi Syslog to get Call Manager Call Traces for troubleshooting.

This Instance of Kiwi Syslog was working fine as a Guest VMware Server on a Host Server.

We used the app Veeam to move the Kiwi Syslog VMware Guest Server to another Host.

This issue started after the copy/move of the Kiwi Syslog

No IP addresses were changed, it's on the same network as before.

It starts up, logs are being received, and then they stop.

If you try to start the service, it tells you it's already running.

At the bottom of the Kiwi Syslog Service Manager, you can see the MPH indicator has stopped.

Looking at the correct folder I can see the logs are no longer being  received.

If I stop the service and start the service it starts.

There is a script that tells it to restart every morning at 4am, and it will do this.

Below is the error event seen when it stopped last time.

Windows Server 2012 R2

64 -bit OS

Has anyone seen this type of issue before?

Any help would be greatly appreciated,

Mhaley