Network Management

SolarWinds Syslog Service does not start

From SolarWinds Platform Service Manager, syslog is stopped.

First published date

12/3/2020 5:34 PM

Last published date

2/5/2025 7:55 PM

Overview

The Syslog service would not start and you will find below errors on the Syslog logs.
 

[UDPListenerThread] ERROR SolarWinds.Orion.Common.SWEventLogging - Port 514 on IP Address 0.0.0.0 is already open.  Change the 'LocalIPAddress' parameter in the configuration file to another IP address or port
 [UDPListenerThreadIpv6] INFO  SolarWinds.Orion.Common.SWEventLogging - Syslog Collector Started on :: IPv6 UDP Port 514
 [TCPListenerThread] INFO  SolarWinds.Orion.Common.SWEventLogging - Syslog Collector Started on  TCP Endpoint 0.0.0.0:1468
 [TCPListenerThreadIpv6] INFO  SolarWinds.Orion.Common.SWEventLogging - Syslog Collector Started on IPv6 TCP Endpoint [::]:1468
 [StartupThread] INFO  SolarWinds.SyslogTraps.Shared.BulkFlush`1 - activating FlushStateWorking
 [13] INFO  SolarWinds.SyslogTraps.Shared.BulkFlush`1 - worker running...
[UDPListenerThreadIpv6] ERROR SyslogService.SyslogService - A blocking operation was interrupted by a call to WSACancelBlockingCall
 [TCPListenerThread] ERROR SyslogService.SyslogService - A blocking operation was interrupted by a call to WSACancelBlockingCall
 [TCPListenerThreadIpv6] ERROR SyslogService.SyslogService - A blocking operation was interrupted by a call to WSACancelBlockingCall
 [6] INFO  SolarWinds.Orion.Common.SWEventLogging - Solarwinds Syslog Service Stopped

Product section

Network Performance Monitor

Cause

The Syslog service would not start because port 514 is being used by another application.
 

Resolution

Perform the following to check what service is running on port 514 and fix the issue: 

  1. Open the Command Prompt as Administrator.
  2. Run the command below to check the status of port 514:
netstat -ano |findstr 514
  1. Check what process ID (PID) that is using port 514.
  2. Get the PID and open the Task Manager to identify the process using the process ID (PID) given in the previous command.
  3. Once you have identified the conflicting process / service, go to services.msc and stop / disable the service.
  4. Go to the SolarWinds Platform Service Manager and start the SolarWinds Syslog Service.
  5. New Syslog messages should be received on the SolarWinds server.