Security Compliance

Syslog events are not appearing in the SEM Console

This SEM article describes what to do if events sent from a syslog device are not appearing in the SEM Console.

First published date

11/29/2018 10:36 PM

Last published date

6/20/2022 4:51 PM

Overview

This Security Event Manager (formerly Log & Event Manager) article describes what to do if events sent from a syslog device are not appearing in the SEM Console.

Product section

Security Event Manager

Cause

This can occur by using an improperly configured or outdated connector, which may be monitoring the wrong log file.

Resolution

Perform an Historical Events & Reports search for all events coming from that connector.
1. Go to SEM Gui > Historical Events.
2. Refine Results > Event Groups and drag the Any Alert.ToolAlias field to the search bar. ("Any Alert".ToolAlias = "*")
3. Type the name of your connector after the equal sign. You can also use a partial name and surround it with asterisks (*) as wildcards. Example: ("Any Alert".ToolAlias = "*Aruba*")
4. Specify a search time frame from the dropdown and click the Search button. If you get no results or only InternalToolOnline/InternalToolOffline events, there might be a configuration issue.
Verify that the connector you have configured for your syslog device is looking in the log file that your device is sending its events to:
1. Go to Configure > Manager connectors and find the connector you've configured. The log being monitored will be shown in the Log File field.
2. Verify that the syslog events are being received in that same log file by searching the raw log file for the IP address of your device. To check the raw log files on your SEM, see Use the CMC checklogs command to display log files
Verify that the connector you've configured is enabled and showing a green status icon.
If everything is configured and you still see no events, your connector may be out of date and unable to parse those particular events. See Updating SEM Connectors.

Disclaimer: Please note, any content posted herein is provided as a suggestion or recommendation to you for your internal use. This is not part of the SolarWinds software or documentation that you purchased from SolarWinds, and the information set forth herein may come from third parties. Your organization should internally review and assess to what extent, if any, such custom scripts or recommendations will be incorporated into your environment. You elect to use third-party content at your own risk, and you will be solely responsible for the incorporation of the same if any.