Tools

Kiwi Log Forwarder fails to start

This article provides brief information and steps to resolve the issue when the Kiwi Log Forwarder stops forwarding syslogs causing the service not to start.

First published date

10/18/2018 8:40 PM

Last published date

7/26/2021 12:41 PM

Overview

This article provides information to resolve the issue when the Kiwi Log Forwarder stops forwarding syslog messages, resulting in the log forwarding service failing to start.

Product section

Kiwi Syslog Server

Cause

The Log Forwarder configuration is corrupted.

Resolution

Warning: This action will remove the existing configuration.

  1. Open the Log Forwarder installation folder: (C:\Program Files(x86)\SolarWinds\Solarwinds Log Forwarder for Windows).
  2. Locate the LogForwarderSettings.cfg file.
  3. Rename this file to OldLogForwarderSettings.cfg.
  4. Restart the SolarWinds Log Forwarder service in Services.msc.
  5. Open the application and recreate the necessary subscriptions.
Please follow the recommenations below in order to prevent the issue from reoccurring, as it's how the subscriptions are configured that will cause the service not to start as expected.

In order to prevent the service from crashing, the recommendation is to create separate Subscription entries for each type of Source specially those that generate a lot of new Event Logs such Application, Security and System.

You may verify which type of source has the most of logs by launching Event Viewer and selecting Windows Logs.