MonitorWare Knowledge Base

I've just downloaded and installed WinSysLog and EventReporter on my Primary Domain Controller NT40sr6. I'm following the 'How to setup Windows NT centralize Monitoring' step by step. At the very end of Major Step 2 it reads 'After Ste 2 is completed, the WinSyslog machine should have a log file in its C:\temp directory. This log will contain events forwarded from the EventReporter agents. Please verify if there is such a file. If it isn't check the setup you made.'

Afer setup I do not have any files in my C:\temp directory.

Thanks

Jeffrey Hunt

In this case, please take a look into the Application Eventlog, and look for error's from WinSyslog or EventReporter Service.

I assume that the folder C:\temp exists.

Another thing you can try to trigger the whole thing is, to lower the LastRecord value on the Application tab in EventReporter Client. The EventReporter will send old events again to teh WinSyslog Server.

Yes, in the Application eventlog there were errors 'Could not connect to Syslog Server over TCP'. There were not any errors at first, but they are there now. I lowered the LastRecord value as well.

On both programs I've change the default protocol to TCP and have specified the TCP/IP address of the machine. For right now I have both EventReporter and WinSyslog installed on the same server.

Thanks for your help.

Jeffrey,

can you please verify that the WinSyslog syslog service configuration does specify TCP as the protocol to use AND that it listens to the same port that EventReporter is sending data to (514).

Rainer Gerhards
Adiscon

Yes, the WinSyslog service configuration does specify TCP as the protocol and I set the port to 1468.

Hi,

change the port to 514 and restart the service, then it should work.

FYI, the port is changed to 1468 because this is normally used for Syslog over TCP.

...let me add that "normally" means Cisco PIX - just to avoid confusion. EventReporter sends to port 514, unless another value is explicitely specified in the services database (typically at \winnt\system32\drivers\etc\services.).

Rainer Gerhards
Adiscon