Quantcast
Channel: THWACK: Popular Discussions - Kiwi Syslog
Viewing all 15803 articles
Browse latest View live

How to Split Logs to Multiple Displays in Kiwi Syslog Server

$
0
0

SolarWinds's own Justin Finley just recorded a video tutorial that shows how to split logs into multiple displays in Kiwi Syslog Server.

 


External link to Jing: Multiple Displays - justinfinley's library

 

Video Guide:

  • 0:00 Unfiltered display (Display 00)
  • 0:10 Showing the rule that sends all messages to Display 00
  • 0:20 Changing the unfiltered display from Display 00 to Display 05
  • 0:25 Checking that the switch happened
  • 0:35 Adding a new filter rule looking for the word "logon" and sending it to Display 01
  • 1:20 Adding a new filter rule looking for the word "logoff" and sending it to Display 02
  • 2:05 Checking that the new filters work
  • 2:25 Renaming "Display 05" to "All Messages"
  • 2:45 Renaming "Display 01" to "Logon" and "Display 02" to "Logoff"
  • 3:10 Checking that the display renaming worked

 

Remember to "LIKE" this if you find it useful - that helps other find it too!


Aruba ClearPass and syslog messages truncated

$
0
0

Hello,

 

I have a problem with my Kiwi Syslog server and syslog messages received from my Aruba ClearPass Server. So I get the messages, no problem with that, but they are truncated. I mean, I don't get the full syslog message.

 

Here is an example : 10-09-2013 11:52:18 Local1.Debug 1.1.1.1 2013-10-09 10:48:42,270 1.1.0.1 Guest Access 66 1 0 RADIUS.Auth-Method=PAP,RADIUS.Auth-Source=Local:localhost,

 

Normally, here are all the information sent by Aruba ClearPass (and that should be present into the message) :

 

RADIUS.Acct-Authentic

RADIUS.Acct-Called-Station-Id

RADIUS.Acct-Calling-Station-Id

RADIUS.Acct-Delay-Time

RADIUS.Acct-Framed-IP-Address

RADIUS.Acct-Input-Octets

RADIUS.Acct-Input-Pkts

RADIUS.Acct-NAS-IP-Address

RADIUS.Acct-NAS-Port

RADIUS.Acct-NAS-Port-Type

RADIUS.Acct-Output-Octets

RADIUS.Acct-Output-Pkts

RADIUS.Acct-Service-Name

RADIUS.Acct-Session-Id

RADIUS.Acct-Session-Time

RADIUS.Acct-Status-Type

RADIUS.Acct-Termination-Cause

RADIUS.Acct-Timestamp

RADIUS.Acct-Username

RADIUS.Auth-Method

RADIUS.Auth-Source

 

As you can see, there are only the last 2 parameters which I can see on Kiwi Syslog. Is there something to setup in Kiwi ?

 

Thanks for you help.

 

Dimitri

Eval version of Kiwi Syslog shows as Free

$
0
0

I had Kiwi Syslog Free version installed. Then I requested 14 day trial version of licensed software. I uninstalled free version and installed 14 day trial, but it still show that it is free version. I uninstalled again. Deleted everything from registry that had word 'kiwi' in it and then installed again. Still same issue. Please, help me have it working. Im really interested. If it works well, I'll be buying paid version.

Kiwi syslog 9.4 on windows server 2012 64bit Service crash - Possible bug!

$
0
0

Hello , kiwi friends!

 

I am trying to get Kiwi syslog 9.4 to work on windows server 2012 64bit but having problems with the service crashing then i try to start the kiwi syslog server console.

I have applied the kb fix for Microsoft .Net Framework 2 , before that i couldnt install kiwi syslog successfully becuse the service could not start.

http://knowledgebase.solarwinds.com/kb/questions/4386/

 

 

I have the following errors in the windows event viewer!

Error 7000: The Kiwi Syslog Server service failed to start due to the following error:
The service did not respond to the start or control request in a timely fashion

Error 7009 : A timeout was reached (30000 milliseconds) while waiting for the Kiwi Syslog Server service to connect.

 

Do you have a solution for this or could it be a new bug in windows server 2012 and the old dot net framework combined ?

 

Thanks in advance.

How to load-balance Kiwi Syslog servers

$
0
0

I've got a set of 3 Kiwi servers sitting behind an F5, which I *thought* would effectively load balance the incoming syslog volume (I'm seeing around 5-8million messages per hour, and we haven't really turned everything on yet).

 

The problem, I just discovered, is that F5 load balances based on connections, not messages/packets. So round robin isn't round robin since most of my sending systems are passing new messages (and therefore creating a connection) more than even the lowest "disconnect after" option on the F5 (which is 1 second).

 

So my first server is maxing out at about 5million MPH and 0% buffer, while server 02 gets 2million messages and 80% buffer, and server 03 gets barely anything at all.

 

Has anyone else tried this, and have you found a work around (it doesn't have to be an F5. I just need the ability to create a pool of Kiwi servers and have all the systems in my enterprise sending to ONE ip address.

 

Thanks!

- Leon

Auto Purge Kiwi Database

$
0
0

I recently had my Kiwi Syslog server DBCache folder filled with over 20GB of cache files.

This was resolved by purging the cache with the "Purge Database Cache" button on the Kiwi menu, however I would love to do this daily or on a schedule when needed.


Is there an easy way to do this or is there an .exe file in the Syslogd folder that I can call on a schedule to perform this task ?

 

Thanks,

TIPS HOW TO - Kiwi Syslog Web Server with SSL and IIS 7

$
0
0

HI all,

 

My first post, i wish to share you some tips i found.

 

My main goal was to have access to the kiwi web site working with SSL...

But looking at Cassinni Web Server, it wasn't possible.

 

After searching more on this forum I found a post about a Rewriting Module with Apache ; so why dont we do it with IIS ?

Here we go !

 

Setup

- Win 2008 R2 , IIS 7 (with auth modules etc ...) , at least a working SSL certificate for the HTTPS listener (this post will not cover how PKI works, certs installation etc .... sorry).

- We will use the ARR 2.0 module x64 for IIS... See References at bottom for DL link, install it.

- A running Kiwi Syslog Server and the Web Access working on port 8088. Access via a browser works on this port.

 

Goal

- Enable the rewrite/proxy module in IIS

- Create a new IIS Web Site with HTTPS Listener on TCP Port 8090

- Create a rule to rewrite requests from 8090 to 8088

- When connecting on https://server:8090 , we would see Kiwi Web page.

 

HOW TO

1. Enabling the rewrite module

"C:\Windows\System32\inetsrv\appcmd.exe" set config  -section:system.webServer/proxy /enabled:"True"  /commit:apphost

 

2. New Site creation

set syslogwebdir=c:\inetpub\syslog

set syslogsitename=SYSLOG

"C:\Windows\System32\inetsrv\appcmd.exe" add site /name:"%syslogsitename%" /id:15 /bindings:https/*:8090: /physicalPath:"%syslogwebdir%"

 

3. Attach the SSL Certificate to the Binding 8090

3.1 With batch/cmd line(copy/past to a BAT file)

set CERTHASH=EnterYourHashHere

netsh http add sslcert ipport=0.0.0.0:8090 certhash=%CERTHASH% appid={00000000-0000-0000-0000-000000000000}

 

3.2 With IIS Manager (if you don't know where to read Hash Certificate).

-Right Click on SYSLOG site, modify Bindings.

-Select https 8090 * Listener > Modify.

-On the "box" SSL Certificate, choose your certificate for the server.

-"OK"

 

4. Create the rule (copy/past to a BAT file)

set syslogsitename=SYSLOG

set syslogrulename="Rewrite to Kiwi localhost 8088"

:: Rewrite Rule creation
"C:\Windows\System32\inetsrv\appcmd.exe" set config "%syslogsitename%" -section:system.webServer/rewrite/rules /+[name='%syslogrulename%']

:: Rule Parameters (one line)
"C:\Windows\System32\inetsrv\appcmd.exe" set config "%syslogsitename%" -section:system.webServer/rewrite/rules /[name='%syslogrulename%'].action.type:"Rewrite" /[name='%syslogrulename%'].match.url:"(.*)" /[name='%syslogrulename%'].action.url:"http://localhost:8088/{R:1}"

5. End

 

Test with your browser https://localhost:8090/

Now you can access from an "admin desktop" to this new SSL web site ...

Configure your firewalls to forbid access on port 8088 to this server (or/and configure the internal Windows Firewall of this server to allow only Localhost connection on 8088).

 

 

6. Refs Used

 

http://learn.iis.net/page.aspx/659/reverse-proxy-with-url-rewrite-v2-and-application-request-routing/

http://learn.iis.net/page.aspx/489/using-the-application-request-routing-module/

 

---

 

At the beginning i was thinking to use http://mysite/syslog/ as a virtual directory, but I got some troubles with events.aspx and the rewrite module.

Inbound Rules was OK ; But Outbound Rules to rewrite URLS were not working as expected ; and filters in Kiwi were not working anymore.

That's why i decided to create a new site on another binding, with a root site ; so don't need to create Outbound Rules ...

 

 

---

 

Sorry for my English ...  i'm french :)

Kiwi Syslog Server Log Location won't change.

$
0
0

Hey all,

 

I have recently taken over a sys admin position, and am required to move the location of the Kiwi Syslog Server logs to another file location. I have never used it prior.  However, I can't seem to move the file.

 

Kiwi Syslog Server 9.2.1 (Free version.)

Windows Server 2003 SP2 (WORKGROUP)(VM)

 

Current configuration:

Log to Log File

Path and file name:  C:\Program Files\Syslogd\Logs\SyslogCatchAll.txt

 

If I test the configuration, I can see the test messages in the location noted about.  However, after I apply the settings, the older location (a CIFS share) continues to receive the actual syslogs of the devices we monitor.

 

There are three local users, all of which show the same configuration.

 

I have tried deleting and recreating the Log to Log File rule.  No change.

I have tried starting and stopping the service.  No change.

I have tried exporting the system settings, and then reimporting them.  No change.

I have tried searching the registery for the old location.  Nothing found.

 

I have two theories.

1.  The settings are locked for some reason.

2.  The settings are stored somewhere else.

 

Any help would be great.

 

Thanks,

 

Aaron

Solarwinds Padawan


Syslog configure to pull Exchange server message tracaking log

$
0
0

looking for a guide to configure syslog server with Exchange server to pull exchange message tracking logs into syslog server.

How to Resolve IP Addresses into Hostnames in Kiwi Syslog Server

$
0
0

SolarWinds's own Justin Finley just recorded a video tutorial that shows how to resolve IP addresses into hostnames in Kiwi Syslog Server.

 


External link to Jing: DNS Resolution - justinfinley's library

 

Video Guide:

  • 0:00 Watching traffic come in with unresolved IP addresses
  • 0:10 Turning on IP address resolution (this affects what appears in the "Hostname" column)
  • 0:20 Turning on in-message IP address resolution (this is optional, can be slow, and affects what appears in the "Message" column)
  • 0:27 A quick glance at the DNS server settings (which DNS server to use, whether NetBIOS is to be used, etc.)
  • 0:29 A quick glance at the DNS cache settings
  • 0:30 Turning on resolution of frequently-uses IPs from a local hosts file (this is very fast, but ignores changes to DNS servers)
  • 0:35 How to edit the hosts file
  • 1:30 Watching traffic come in with properly resolved IP addresses

 

Remember to "LIKE" this if you find it useful - that helps others find it too!

Need Help Troubleshooting - Not Receiving/Displaying Messages

$
0
0

Server 2008 R2 Std

Kiwi Syslog Server 9.4.1

 

I have an older version of Kiwi installed on an old server that is being retired.  I've installed it on the new server, but I cannot get it to display anything.  I exported settings from the other server and imported on this one, then went to Inputs-UDP and set the correct IP to bind it to.

 

  • I've gone through ALL the steps at SolarWinds Knowledge Base :: Kiwi Syslog Daemon is not receiving messages and Kiwi Syslog Server but had no luck getting it to work.
  • I know for a fact that messages are being received -- when I run WireShark with the filter, "udp port 514", I see PLENTY of traffic from my firewall.  Both my firewall and VPN device are sending syslog messages to the old server and the new one.  The old server is still working just fine.
  • Windows Firewall on the new server is completely disabled.
  • I loaded the default rules and settings but still had no luck.
  • I disabled all DNS resolution - no luck.
  • There is no Errorlog.txt in C:\Program Files (x86)\Syslogd.
  • Test messages from within Kiwi work just fine.
  • I finally uninstalled Kiwi, rebooted the server, then reinstalled, and have the same problem.

 

Kiwi is running as LocalService -- I wondered if that might be the problem, but that's how it's running on the old server as well.

 

I'm at a loss as to what to do now.  I tried contacting support, but since I'm using the free version I was directed here.

How to Split Log Files by IP Address and Date in Kiwi Syslog Server

$
0
0

SolarWinds's own Justin Finley just recorded a video tutorial that shows how to split logs into multiple files by IP address and date in Kiwi Syslog Server.  Specifically, this syslog server tutorial shows how to store logs in separate folders for each source IP address, and then shows how to keep separate log files for each day within those folders.  (e.g., "D:\logs\192.168.000.001\Log2012-07-13.txt")

 

 

External link to Jing: autosplit - justinfinley's library

 

Video Guide:

  • 0:00 Opening Kiwi Syslog's configuration dialog
  • 0:15 Using an "AutoSplit" variable of "IP Address (4 octets)" (%IPAdd4) in the log path to split logs by IP address
  • 0:40 Using an "AutoSplit" variable of "ISO Date" (%DateISO) in the log path to split logs by date

 

Remember to "LIKE" this if you find it useful - that helps other find it too!

Kiwi Syslog Web Access is doubling entries

$
0
0

Everytime there is an entry in the Syslog server it doubles it on the Web Access page. Does anyone know how to fix this?

Kiwi Syslog + PFsense (parsing firewall log from 2 lines to 1 help)

$
0
0

PROBLEM - pfSense syslogs for firewall event is split into two lines when it is sent to Kiwi syslog app.

 

Is there a way to edit configuration or parsing script to parse the pfSense event as one similar to what the Splunk app can do see link http://www.basementpctech.com/content/pfsense-log-analysis-splunk

 

I understand that this is a PFsense tcpdump/issue, but I have already tried changing link http://redmine.pfsense.org/issues/1938 without any luck, it just don't work, tried all combinations of changes without any luck.

 

Pfsense version = 2.0.1-RELEASE, (amd64) , built on Mon Dec 12 18:16:13 EST 2011 ,FreeBSD 8.1-RELEASE-p6

 

I would really appreciate any help with this, as I have already exhasted searching for a working soloution using Kiwi Syslog, and the only thing holding me back from purchasing this application.

 

Appreciate any help on this..........

 

 

Example from Kiwi Syslog

 

02-06-2013 13:01:35 Local0.Info 10.x.x.x Feb  6 13:01:37 pf: <009>  Client-Ethernet-Address 00:50:56:9d:53:fc [|bootp]

02-06-2013 13:01:35 Local0.Info 10.x.x.x Feb  6 13:01:37 pf:     10.x.x.xx.68 > 255.255.255.255.67: BOOTP/DHCP, Request from 00:xx:56:9d:53:fc, length 313, xid 0xf7d8ecbb, secs 3328, Flags[bcast]

02-06-2013 13:01:35 Local0.Info 10.x.x.x Feb  6 13:01:37 pf: 00:00:08.003040 rule 1/0(match): block in on em0: (tos 0x0, ttl 128, id 12646, offset 0, flags [none], proto UDP (17), length 341)

02-06-2013 13:01:35 Local0.Info 10.x.x.x Feb  6 13:01:37 pf: <009>  Client-Ethernet-Address 00:xx:56:9d:53:fc [|bootp]

Host reporting incorrect IP address of 127.0.0.1 in syslog

$
0
0

I'm using Kiwi Syslog free edition. I'm testing it to see if it does what I need, and I've already run into a snag.

 

I have to identical 2821 voice routers. They both are configured with the same logging setup.

 

logging trap debugging

logging facility local2

logging source-interface GigabitEthernet0/0

logging 10.2.100.235

 

On the syslog setup, I've specified the IP addresses of each router as "inputs"

 

The syslog messages are coming in as expected, but one of the 2 hosts always shows up as 127.0.0.1 in the hostname field.

 

I've double checked the source interfaces and they're correct.

 

Anyone have any idea why this is happening?

 

Thanks!


Procurve switches not sending syslog messages in KIWI syslog

$
0
0

Hi all,

 

New here, searched for discussions but found no entry on procurve switch(es).

The Procurve switches will not send any syslog messages (wiresharked the server)

Turned on logging on the switch: logging 'ip-address'

 

show debug

 

Debug Logging

  Source IP Selection: Outgoing Interface
  Destination:
   Logging --
     'ip-address' Kiwi Syslog server

       Protocol = UDP
       Port     = 514
     Facility = user
     Severity = info
     System Module = all-pass
     Priority Desc =

 

tried facility 'syslog' still nothing.

 

Only the Procurve switches will not send any syslog messages.

Other devices such as Cisco ASA's work fine.

 

Anyone ideas to solve this?

 

TIA Jaap

Filter question: network range AND specific IPs

$
0
0

I currently have a rule set up to filter syslogs coming from a range of IPs (using the IP address > IP Mask setting). However, I also need to include IPs from a different network.

 

Example:

 

Currently I have 172.16.0.0 / 255.255.240.0

 

I need to also include specific IPs in another network, like 192.168.1.33, 192.168.1.78, etc.

 

I'm pretty sure I can do this with RegEx, but a bit lost from trying to parse the Help for that section.   Would it be something like "172.16.{1-254}.{1-254}" "192.168.1.33" "192.168.1.78" ?

Kiwi Syslog Server Web Interface Very Slow

$
0
0

I just setup an evaluation installation of the Kiwi Syslog Server and it's Web Access component.  I have one relatively high volume system logging to it.

When I search for specific logs using filters in the Web Access, it takes a very long time fetching the events.  If this is the case with only one system logging to it I am concerned about performance if I have a bunch more systems log to it.

Is this typical behavior for Kiwi Web Access?

Kiwi syslog IPv6 support roadmap

$
0
0

Does Kiwi syslog support IPv6 at future version?

Kiwi Syslog Server Log Location won't change.

$
0
0

Hey all,

 

I have recently taken over a sys admin position, and am required to move the location of the Kiwi Syslog Server logs to another file location. I have never used it prior.  However, I can't seem to move the file.

 

Kiwi Syslog Server 9.2.1 (Free version.)

Windows Server 2003 SP2 (WORKGROUP)(VM)

 

Current configuration:

Log to Log File

Path and file name:  C:\Program Files\Syslogd\Logs\SyslogCatchAll.txt

 

If I test the configuration, I can see the test messages in the location noted about.  However, after I apply the settings, the older location (a CIFS share) continues to receive the actual syslogs of the devices we monitor.

 

There are three local users, all of which show the same configuration.

 

I have tried deleting and recreating the Log to Log File rule.  No change.

I have tried starting and stopping the service.  No change.

I have tried exporting the system settings, and then reimporting them.  No change.

I have tried searching the registery for the old location.  Nothing found.

 

I have two theories.

1.  The settings are locked for some reason.

2.  The settings are stored somewhere else.

 

Any help would be great.

 

Thanks,

 

Aaron

Solarwinds Padawan

Viewing all 15803 articles
Browse latest View live


<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>