MonitorWare Knowledge Base

Hi, I'm trying Winsyslog/Eventreporter/logger in a new server environment, with most W2k3 and a few RedHat AS/Fedora.
I've installed Winsyslog on the server (A) that should collect all logs, where I want all filtering/logging/etc to take place. On that same machine (A) I'm running the interactive syslog viewer. I got many syslog lines from the very same machine (A), just a few (3-4) from one (B) of the servers (W2k3 + Snare agent: UDP 514), not more from a second (C) one (W2k3 + EventReporter sending all events on udp 514 to A), a few from fedora (using std syslog D). Just to test for connectivity and/or config I've tryed logerr on (A), sending a message to (A), but it never went thru. If logger uses -m 3195raw I get a msg: "Couldn't connect to host, sock err 10061". What I'm missing?
Thanks in advance for any help (or pointer to) you can provide.
Luigi

Hi Luigi,

this is difficult to say without more details. Please use our customer support at support@adiscon.com and attack your current WinSyslog configuration as registry file. Then our support can take a look to it and help you to solve this issue.

best regards,
Andre Lorbach

well, the logger issue actually is simple to solve, it is just an uncommon switch that Andre overlooked The -m 3195 means that RFC3195/raw transmission is used. I guess you do not have configured any syslog server to use that. So if you really (really?) intend to use 3195, you need to enable that in the receiver. I'd just caution against using it, because nobody has done so in the past 5 years so it probably has a number of bugs. I suggest plain tcp instead... (I am not saying it doesn't work, I am just saying there is some risk with that unproven code, even though it passes all internal tests...).

Rainer