Syslog service unexpectedly starts or stops

10/22/2018 3:08 PM

7/5/2022 10:29 AM

This article provides brief information and steps to resolve the issue when the SolarWinds Syslog services unexpectedly starts or stops causing the Windows Event log to fill up with errors and see the below error in corresponding log file. Restarting Services / Reboot of Server has no affect and IPv6 was not enabled

2016-11-14 11:35:02,528 [UDPListenerThreadIpv6] ERROR SolarWinds.Orion.Common.SWEventLogging - Syslog Service Unhandled Exception Only one usage of each socket address (protocol/network address/port) is normally permitted
   at System.Net.Sockets.Socket.DoBind(EndPoint endPointSnapshot, SocketAddress socketAddress)
   at System.Net.Sockets.Socket.Bind(EndPoint localEP)
   at System.Net.Sockets.UdpClient..ctor(IPEndPoint localEP)
   at SolarWinds.Syslog.UdpPacketListener`1.ListenForSyslogPackets(Boolean isIpv6, IPEndPoint localEndPoint, IRunState runState)
   at SyslogService.SyslogService.ListenForUDPPacket(Object ipv6)
   at System.Threading.ThreadHelper.ThreadStart_Context(Object state)
   at System.Threading.ExecutionContext.runTryCode(Object userData)
   at System.Runtime.CompilerServices.RuntimeHelpers.ExecuteCodeWithGuaranteedCleanup(TryCode code, CleanupCode backoutCode, Object userData)
   at System.Threading.ExecutionContext.RunInternal(ExecutionContext executionContext, C

Orion Platform

The error is caused by another server listening on port UDP 514 OR

It could also be caused by recent attempts to upgrade to NPM and a roll back on a VM environment.

OR

It could also be due to broken syslog service

OR 

Upon reboot syslog service of another application started prior Orion syslog server starts making the port unusable

Check what service is running on port 514: 

1. Open CMD with admin rights

netstat -ano |findstr 514

2. Check what process ID that is using port 514

3. Open Task Manager and identify the process using the process ID given on the previous command

4. Once you have identified the conflicting process / service, go to services.msc and stop / disable the service.

5. Go to Orion service manager and start syslog

6. New Syslog messages should be recieved on the Orion server

 

If none of the above helps, and you don't see any services using port 514 and syslog restart when look at Orion Service Manager, then doing a repair of Orion Core should fix the problem or Reinstall Syslog service