I have a small environment that is being required(regulated) to gather and store Windows Server and Cisco FW logs. We currently have two sites with servers. Whats the best practice to get High Availability of log collection without killing WAN link. I was thinking that you can have every server send logs to a log collector at each site, Is this best practice?
Thanks,
JimBob
Hi all.
I have just installed Kiwi Syslog Server 9.5 on a test machine to evaluate its suitability for a project I'm working on. It's currently still running in 14-day Evaluation mode.
We can't seem to get it to receive SNMP traps at all. No matter what we do, netstat shows nothing listening on UDP port 162. SNMPv1 traps are being sent to the server, and we can see them in Wireshark arriving at the server, but Kiwi isn't listening for them.
In desparation, we tried enabling the Windows SNMP Trap service (although we understand this isn't required?) and this 'absorbed' the traps, but nothing appeared in Kiwi.
The test machine is running Windows 7 (32-bit) with the Windows Firewall switched off.
Should the 14-day Evaluation be able to receive SNMP traps?
Thanks in advance for any advice!
Hi I have just upgraded to 9.3.4 syslog server and I am having trouble with setting up new actions with timers counters.
I have approx 20 rules defined and approx 5 of them need a Time Interval Filter.
These filter syslogs from various cisco hardware, one being Fan Faults.
The intial Filter is set to Include = "%FAN" "%ENVIRONMENT" - works a treat
the 2nd filter is a Flag/Counter for Time Interval - currently set to 60 mins
Actions are . 1 = display in ErrorFan,
2. Send snmp trap to server 1
3. forward syslog to server 2
When the timer is enabled the syslogs only show 1 every 60 mins for all devices. We currently have 8 bits of kits reporting fan rotation errors etc, and with the timer set I am only seeing the same device or two every hour - not all 8.
When i remove the timer the syslogs come through every 30sec-1min intreval from each device.
In the Syslog Help guide it states:
"When a message arrives from the host "central-router.company.com" that
contains the words "link down" in the text, the first filter (Message text) will
be true. The Time interval filter is then processed. The first time the Time
interval filter is processed, the result will be true, and the actions that
follow will be performed. A countdown timer using the specified value is
started. In the above example it is 15 minutes. If another message arrives from
the same host that contains the words "link down", the first filter (Message
text) will again be true. If the countdown timer has not reached zero, the Time
interval filter will return false and the actions following will not be
performed."
I cannot get this to work 'per host' it just stops all messages coming through from ll devices except 1.
So I dont think it is correctly storing 'counter/flag' for each host and is just setting the filter for the first message received from any host.
I would also like to know if 60 mins is the maximum, as this can still be quite annoying for backend systems, and It would be great to see this increase to maybe 3 or 4 hours - or to be able to put a once a day for each host filter on. Is there a way around this? for instance can i put a 2nd time interval timer on (when it works properly) for a further 60mins etc so i would get 120 mins in total?
Hi,
I'm trying to uninstall the 14 day trial of syslog server (9.4.1) eval. installed on Windows Server 2003.
There is no uninstall service on the management menu drop down. as per the instructions.
"Using the Service Manager, uninstall the service
Use the Manage | Uninstall the Syslogd service menu."
Some help required please.
Simon.
Using Syslog Service Manager Version 9.0.3 I am trying to archive the logs on an hourly basis. When I test the schedule with the run now it errors with: Task engine aborted with error: Problem copying file [Syslogd_Taskengine.exe 2.5.148] (45600) Main () Win32 file rename failed [Line: 0]
Hi community. I ve searched about my problem but only found topics related about Orin software. I am getting an exception in Kiwi Syslog Web Access. Status Code 500. Any one have experienced this issue ? Thanks a lot.
Exception of type 'System.Web.HttpUnhandledException' was thrown.
Status Code: 500
System.Web.HttpUnhandledException: Exception of type 'System.Web.HttpUnhandledException' was thrown. ---> System.ArgumentOutOfRangeException: 'capacity' must be non-negative.
Parameter name: capacity
at System.Collections.ArrayList..ctor(Int32 capacity)
at RadGridUserSettings.GetSerializedSettings()
at _Event.Render(HtmlTextWriter writer)
at System.Web.UI.Control.RenderControlInternal(HtmlTextWriter writer, ControlAdapter adapter)
at System.Web.UI.Control.RenderControl(HtmlTextWriter writer, ControlAdapter adapter)
at System.Web.UI.Control.RenderControl(HtmlTextWriter writer)
at Telerik.Web.UI.RadAjaxControl.RenderPageInAjaxMode(HtmlTextWriter writer, Control page)
at System.Web.UI.Control.RenderChildrenInternal(HtmlTextWriter writer, ICollection children)
at System.Web.UI.Control.RenderChildren(HtmlTextWriter writer)
at System.Web.UI.Page.Render(HtmlTextWriter writer)
at _Event.Render(HtmlTextWriter writer)
at System.Web.UI.Control.RenderControlInternal(HtmlTextWriter writer, ControlAdapter adapter)
at System.Web.UI.Control.RenderControl(HtmlTextWriter writer, ControlAdapter adapter)
at System.Web.UI.Control.RenderControl(HtmlTextWriter writer)
at Telerik.Web.UI.RadAjaxControl.RenderPageInAjaxMode(HtmlTextWriter writer, Control page)
at System.Web.UI.Control.RenderChildrenInternal(HtmlTextWriter writer, ICollection children)
at System.Web.UI.Control.RenderChildren(HtmlTextWriter writer)
at System.Web.UI.Page.Render(HtmlTextWriter writer)
at _Event.Render(HtmlTextWriter writer)
at System.Web.UI.Control.RenderControlInternal(HtmlTextWriter writer, ControlAdapter adapter)
at System.Web.UI.Control.RenderControl(HtmlTextWriter writer, ControlAdapter adapter)
at System.Web.UI.Control.RenderControl(HtmlTextWriter writer)
at System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)
--- End of inner exception stack trace ---
at System.Web.UI.Page.HandleError(Exception e)
at System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)
at System.Web.UI.Page.ProcessRequest(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)
at System.Web.UI.Page.ProcessRequest()
at System.Web.UI.Page.ProcessRequestWithNoAssert(HttpContext context)
at System.Web.UI.Page.ProcessRequest(HttpContext context)
at ASP.events_aspx.ProcessRequest(HttpContext context)
at System.Web.HttpApplication.CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()
at System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously)
Resource: http://localhost:8088/Events.aspx
Referrer: http://localhost:8088/Gateway.aspx
Click here to return to the previous page Click here to return to the login page
Hi eveyone
I have a problem with my syslog server, it send he following messages:
Service running, but Service/Manager comm link is not connecting.
Unable to connect to Service socket on TCP port 3300
The server is installed on a windows 7 virtual machine on an vmware enviroment, I already verified the TCP port and it belongs to the syslog server, also the windows firewall is down
Do you have any ideas?
Regards
Hi all.
I have just installed Kiwi Syslog Server 9.5 on a test machine to evaluate its suitability for a project I'm working on. It's currently still running in 14-day Evaluation mode.
We can't seem to get it to receive SNMP traps at all. No matter what we do, netstat shows nothing listening on UDP port 162. SNMPv1 traps are being sent to the server, and we can see them in Wireshark arriving at the server, but Kiwi isn't listening for them.
In desparation, we tried enabling the Windows SNMP Trap service (although we understand this isn't required?) and this 'absorbed' the traps, but nothing appeared in Kiwi.
The test machine is running Windows 7 (32-bit) with the Windows Firewall switched off.
Should the 14-day Evaluation be able to receive SNMP traps?
Thanks in advance for any advice!
Hello,
I'm currently trying to get the logs of where (what IP) and when (date and time) the Domain Administrator account information is used to log into one of three specific machines (2 DC's, and a Finance server). I'm having some trouble defining the subscription in the Kiwi Log Forwarder - Specifically, what boxes do I need to tick off and what event ID number do I need to include? I have the IP's for the three servers that I want AD to send the Admin login logs from. Thanks!
Hi,
Then syslogd service runs fine on our windows server 2016 DC.
But if we open the console, it hangs. Memory and CPU load are ok.
Any idea what I can check ?
Best Regards,
Wouter Jinssen
Siemens
we are experiencing the below events:
Event ID: 1000
Faulting application name: Syslogd_Service.exe, version: 9.6.3.3, time stamp: 0x5a0da76b
Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000
Exception code: 0xc0000096
Fault offset: 0x065685f4
Faulting process id: 0x%9
Faulting application start time: 0x%10
Faulting application path: %11
Faulting module path: %12
Report Id: %13
Faulting package full name: %14
Faulting package-relative application ID: %15
Event ID: 1026
Application: Syslogd_Service.exe
Framework Version: v4.0.30319
Description: The process was terminated due to an unhandled exception.
Exception Info: exception code c0000096, exception address 065685F4
Stack:
the service can be manually started successfully, however it stops with the above errors on a seemingly random basis (at least once a day).
EDIT 17:38 19/04/18 - I discovered that the service fails when a scheduled job (to archive) the syslog files is activated - but not when manually ran.
Hi,
I have recently been handed over Kiwi Syslog server to manage which has both Fat Client and Web Server. Fat Client is directly logged in however Web console could not be logged in. When I checked regarding the password of "Administrator", I have been informed that resource handling it has left long ago and there is no one to tell.
Is there a way we can reset the password of Administrator or create a new user from Syslog Fat Client. I cant raise the request with Support as we do not have active maintanence.
Thanks,
Syed
i installed log forwarder 2.1.0 on my windows server 2008. i set my kiwi syslog server, i configured subscription for sending system logs from my server. when i click to test button, the test is ok, but in event viewer i receive in log solariwinds.net i receive message
Unable to setup Windows Event Log subscribers. Subscribe failed with error 15001, The specified query is invalid.
also, my kiwisyslogserver does not receives messages. where is problem
I am needing to forward all of our DHCP audits to the syslog, however I cannot figure out how to do that with the Log Forwarder. Which source do I use in the Event Viewer? The audit is logged to a file. Is there any way to forward changes to files?
I'm trying to forward events from Kiwi Syslog to QRadar SIEM.
In Kiwi Syslog setup, I created an Action: Forward to another host; gave it the QRadar appliance's IP as the Destination IP; selected "Retain the original source address of the message"; clicked the Test button to verify the configuration and got a gree checkmark.
The test event was the only event received by the QRadar. None of the events I'm forwarding have been received as incoming logs on QRadar.
I've tried this with and without adding the Kiwi Syslog servers as log sources in QRadar.
Do I need to install a universal DSM on the Kiwi Syslog servers?
Hi,
How can I update the refresh time on KWSA please? Everytime I click on "Save", I've got the password policy message.
Thanks
Hi Folks, I am starting to evaulate Kiwi Syslog Server and one of the main requirements will be how we provision HA (High Availability)
I have seen some posts regarding the use of LB's (Load Balancers) but these posts are pretty old and don't go into that much detail.
I'm hoping that someone can point me in thr right direction.
If we use 2 LB's in a cluster (probably Netscalers) all clients will connect to the LB VIP.
I'm "guessing at this stage" that the LB's will send all trafiic to one of 2 Kiwi Syslog servers (lets call them Kiwi A and Kiwi B where Kiwi A is the current live server)
We are resilient against the loss of a LB (as theye are operating in a HA Cluster)
If we lose Kiwi A, traffic will be redirected to Kiwi B.
Thoughts/Comments
If we lose a LB, we will probably lose syslog records - I don't think its possible to avoid this (even if we use TCP)?
If we lose Kiwi A, syslog records will be redirected to Kiwi B by the LB (again, I think we could lose some syslog records)
If we need old logfiles on Kiwi A (that isn't now available) - I guess we can't unless Kiwi A writes to a CIFS share (that Kiwi B also writes to) ???
If we don't have access to a direct CIFS share, could we use Windows DFS (so that Kiwi A is replicating to Kiwi B and vice-versa) - again, I think we will miss records.
So basically, if we lose Kiwi A, and the LB starts writing to Kiwi B, Kiwi B will have the replicated records (via DFS from Kiwi A)
Kiwi B should pretty much have almost all of the records available (would need to test this against busy input devices)
Before we go down this road and start testing, It would be great if anyone has any information/feedback/comments they could provide.
Many Thanks.
Does anyone know of a way to import/export rules to/from KiWi Syslog Server via command line or other means?
We have a very heavily utilized LEM with a "farm" of KiWi syslog servers sitting behind a load balancer. When ever we change the rule on one KiWi server, we need to manually export the rule and import it to the KiWi servers.
We would like to find a way to script this, but we cannot find any relevant CLI options in the admin guide. If anyone has done this or has a suggestion, it would be greatly appreciated.
If this is not possible, then would anyone find interest in a supporting a feature request to have a centralized management console for large deployments of KiWi syslog servers?
Thanks!
In the web access settings page, when I try to modify the value of page refresh or anything under the "general settings" screen it pops up an error about changing the password. I am not modifying anything under the "user settings" part or clicking "change password". Any ideas?
Is there any way for me to export Kiwi Syslogs. I want to be able to export the syslogs from a licensed Kiwi server into another database for viewing. Specifically the NPM database. I would think that there would have been something to do this already since both are SolarWinds products, but I am unable to find it.
I want to be able to take the logs off the Kiwi server and view them elsewhere, without viewing through Kiwi. I want to view them through NPM, but I guess I can get by viewing them through something like Access. Is there a way (even if it isn't easy) to do this?