Tools

The Solarwinds.Kiwi.Syslog-Log is filled with "Field LocalAddress wasn't updated from script, because value "ANY" is invalid." messages

The Solarwinds.Kiwi.Syslog-Log is filled with the following message (over nine million entries): [WRN] Field LocalAddress wasn't updated from script, because value "ANY" is invalid.

First published date

3/2/2026 7:29 PM

Last published date

3/2/2026 7:29 PM

Overview

The warning is coming from Kiwi Syslog Server NG’s script/forwarding engine, and it’s a known issue where it can fire on every script run, effectively flooding SolarWinds.Kiwi.Syslog-*.log.

What that message actually means is when a Run script or forward to host action finishes, Kiwi NG tries to copy variable values back into message fields (IpAddress, LocalAddress, etc.). If the value your script provides is not syntactically valid for that field, Kiwi logs:
[WRN] Field <FieldName> wasn't updated from script, because value "<value>" is invalid. and simply leaves that field unchanged. 

Product section

Kiwi Syslog Server

Cause

Field LocalAddress wasn't updated from script, because value "ANY" is invalid.

means the script/engine is trying to write "ANY" into the LocalAddress field. "ANY" is just an internal placeholder for “bind to any local address”; it is not a valid concrete IP/host value for the LocalAddress field, so the write is rejected and logged as a warning.

Every time the script action (or sometimes a scripted ForwardAction) runs, Kiwi NG tries to push "ANY" back into LocalAddress and logs this warning.

Resolution

The warning itself is cosmetic: Kiwi continues processing messages; LocalAddress simply stays unchanged.

But in practice: It inflates SolarWinds.Kiwi.Syslog-YYYY-MM-DD.log, and combined with other script/forward errors has been tied to very large log files and high memory usage in multiple environments.

Resolution:

  1. Identify the exact rule + action causing this (likely a Run script or forward to host on a high‑volume rule).
  2. Temporarily disable that action and confirm the warnings stop.
  3. Fix the script/forward config so LocalAddress is never written as "ANY" (or don’t touch it at all).
  4. Alternatively, the below setting can be changed in the Kiwi.Service.Settings.json from

             "SyslogLocalIpAddress": "ANY", //The local IP address the syslog service is listening on.

               to

              "SyslogLocalIpAddress": "Your local IP", //The local IP address the syslog service is listening on.