Submit a ticketCall us

Don’t fall victim to a ransomware attack
Backups are helpful, but sometimes that’s not enough to protect your business against ransomware. At our live webcast we will discuss how to protect against ransomware attacks with SolarWinds® Patch Manager and how to leverage log data to detect ransomware. Register now for our live webcast.

Home > Success Center > Kiwi Syslog Server > Kiwi Syslog Daemon Quick Start Guide

Kiwi Syslog Daemon Quick Start Guide

Table of contents

Updated March 11th, 2016

Overview

This article provides steps to help you troubleshoot and get started with Kiwi Syslog Daemon.

Environment

All Kiwi Syslog Daemon versions

Steps

If you have installed Kiwi Syslog Daemon but are not receiving syslog messages from your devices, the first thing to do, is confirm that they are actually being sent.

  1.  To do this: I recommend using an application called Ethereal, http://www.ethereal.com (© 2017 Alexander Open Systems, available at http://www.aos5.com/cloud_acquired, obtained on June 28, 2017.). This application provides the ability to capture traffic that is sent to your systems Network Interface Card. By capturing this traffic you will be able to determine whether or not the syslog messages are actually arriving at your system.
  2.  If they are not being sent, then you will need to check the settings on the network device itself. We find that often the device requires a reboot for the settings to take effect. 
  3. You may have a firewall installed such as ZoneAlarm which blocks access to this port. If you are running a Windows 2003 server, the Windows firewall is turned on by default.
  4. You may have another application running that uses UDP port 514 to listen on, or You will need to identify what that process is. I would suggest you use:
    • If your devices are sending syslog messages, but Kiwi Syslog Daemon doesn't show any logging on display or in a file; I recommend the following:
  5. From "File | Setup | Defaults/Import/Export" hit the "Load the default rules and settings" button, hit the "OK" button, stop and restart the application and you should start seeing the messages on the display.
  6. Download a copy of Kiwi SyslogGen from the Download Kiwi Products page and use it to send 'test' messages from your remote servers, and/or other machines. This will establish if the syslog messages can be received, and that Kiwi Syslog Daemon is working correctly.
  7. Ensure that you do not have the "lock" icon enabled in the Kiwi Syslog Daemon Main window. If the lock icon is enabled, you will not be able to view messages in the display windows.
  8. Reboot the system you have Kiwi Syslog Daemon installed on.
  9. Have a look at your errorlog.txt in your C:Program filesSyslogd folder for some indication as to what is wrong.
  10. Please click on the Manage | Debug options | Get diagnostic information menu option and zip and send us the diagnostic information.
  11. Export your settings via the FILE | EXPORT SETTINGS TO INI FILE menu and send us this saved file as an attachment.
    • Windows | Start | Run | command => netstat €“aon

 

This will identify the process identifier number of the process which is bound to 514. Then in your Task Manager, ensure you have set your Options | Select Columns to include PID, and see which process that relates to. End the process/s and restart Kiwi Syslog Daemon.

 

Disclaimer: Please note, any content posted herein is provided as a suggestion or recommendation to you for your internal use. This is not part of the SolarWinds software or documentation that you purchased from SolarWinds, and the information set forth herein may come from third parties. Your organization should internally review and assess to what extent, if any, such custom scripts or recommendations will be incorporated into your environment.  You elect to use third party content at your own risk, and you will be solely responsible for the incorporation of the same, if any.

 

 

Last modified
10:43, 28 Jun 2017

Tags

Classifications

Public