WinSyslog

The Enhanced Syslog Server

Tag Archives: Configuration

Creating a sample WinSyslog 4.2 configuration

Posted on by

In this online Seminar, Wajih-ur-Rehman uses a freshly installed copy of WinSyslog and has it write to a text file as well as generate email alerts if a specifc string is present inside the message.

The specific requirements achieved during this session are:

  • WinSyslog will receive syslog messages over the standard port of 514/UDP
  • All received messages should be stored to the local file system. There should be one file for each device that is sending syslog messages
  • Messages containing the string “Alert” should generate an email alert to admin@example.com

This is a common scenario often asked for. Besides the actual configuration, the seminar gives a good idea on how the configuration client can be used to configure rule sets. It also shows how multiple actions can be configured in a single rule set.

Click here to start the seminar – please note that it was taken at 800 by 600 screen resolution.

For best viewing experience, please maximize the Media Player Window. In order to view the seminar, Windows Media Player is required (preferably version 7 or higher). If you do not have Windows Media Player, please visit Microsoft’s web site for a free download.

We appreciate your feedback. Please email us your comment or suggestion to info@adiscon.com!

How To Configure a Syslog Server

Posted on by

This article is also available as an interactive guide. Simply follow this link:
How to configure a Syslog Server – Interactive Tutorial
Macromedia Flash Player is needed.

1. Right Click on Services -> Add Service -> Syslog Server

2. Give some name of this Syslog Server. I will be using the default name which is “Syslog Server 1”. Click on “Next” and then click on “Finish”

3. Now you will see a new node in the Tree View on the left hand side under the “Running Services” node with a name “Syslog Server 1”. Click on it. It will open up the configuration page for this service on the right hand side as shown below:

4. Now change the protocol type to UDP (if you are reading the step by step guide for configuring with PIX). Change the port to 514 as shown below:

5. Once you make these changes, you will see a yellow highlighted text that says “You have changed but not saved”. Press the Save button on its right to save the settings.

6. Now click on the play button at the top as shown below:

How to configure Monilog?

Posted on by
For Configuring MoniLog

You would need:

  • 1 MoniLog to automatically generate consolidated reports based on the gathered log data at the central server.
  • To deliver MoniLog reports, you need a local web server (for example Microsoft’s IIS or Apache) and a mail server capable of talking SMTP (most modern servers support this).

You need administrative privileges on each of the machines. This is required both for installation and configuration. Make sure you log on with a sufficiently privileged user account.

Preparing Web Server for MoniLog

MoniLog publishes its reports through the local web server (central hub server).

To avoid confusion, we recommend creating a separate directory on the web server for MoniLog. Let us assume you use Microsoft Internet Information Server and run it in the default configuration. Then, you web pages are stored in the c:\inetpub\wwwroot directory. Create a subdirectory “monilog” directly beneath this directory.

Installing and Configuring MoniLog

Click to Download Monilog. Log on interactively to the web server. Then, run the MoniLog setup with default parameters. When setup has finished, start MoniLog, select your language (I have used English for this tutorial) and perform the following steps:

1. First, switch to the “General” tab.

2. “Logs Location” expects the DSN or Location where log files are dumped. You can either specify the name of your database or logs location. In this sample once we have configured the settings with a databse (screenshot 1) and then with logs location (screenshot 2) respectively for providing a guideline. We have named the DSN for our database “MyDatabaseDSN” and the Logs Location “c:\temp”. Replace these values according to your environment.

3. Select your “Select Syslog server type”.

4. Next is to check the “Process Non-Windows Syslog messages” box. Leave all other options by default. Now it should look as follow:


Figure 1: General Tab Settings Form – For Database


Figure 2: General Tab Settings Form – For Log Files

Click “Apply” after making your changes!

5. This has already enabled MoniLog reporting. Now, we can verify the installation. To do so, switch back to the “Profiles” tab. Click the “New Profile” button and enter a name. In this example I use the name “Profile 1”.


Figure 3: Creating New Profile

Click “OK” button to create a new profile.

6. Under “Reports Location”, enter the directory where MoniLog reports should be stored. In our sample, we use “c:\inetpub\wwwroot\monilog”. Leave all other settings as default. The tab should look like this one:


Figure 4: Configuring Reports Location

Click “Apply” to save your changes!

7. Next step is to set your report options. To do so, click “Report Options”. A new window opens. Check Success Audit and Information. Now it should looks like this one:


Figure 5: Report Options Form

Click on “OK” to close the windows by using default options.

8. Click “Analyze now” to test it. After a short while, a browser window with a MoniLog report will appear. The actual content of this report varies greatly. It depends on which events have been forwarded while setting up the agents. Probably, your report will be empty. This simply indicates that there was not yet any data to be analyzed. Immediately after setup, this is OK. If you don’t receive any data after some hours then of course there is something wrong. If that is the case, check the steps done before. The report should look like shown on the screen below:

Figure 6: A typical Monilog report

9. Now we have verified the system is working. Next, we can schedule the automatic report. To do so, we need to check “Enable Schedule” and also “Enable Email delivery”. A quick reminder: we would like to receive a pointer to the report via email each working day. We first need to set the web directory the reports are to be stored to and enable email delivery. It is all done in the following screenshot:


Figure 7: Enabling Email delivery and report scheduling options

The “Email Options” and “Scheduled Options” become colored and are now available.

10. Now we need to configure the email options. Click “Email Options…”. We assume the web server (192.168.0.1) is also acting as a mail server. The emails should be sent to “admins@sample.adiscon.com”. With that, the dialog looks like follows:


Figure 8: Configuring Email notification settings

Important: make sure the values match your configuration! This is vitally important because otherwise MoniLog is incapable of sending email correctly. Click “OK” to apply the new settings.

11. Next, click the “Report Options…” button. As we schedule reports only on working days, we need to tell MoniLog that it should include all those events occurred since its last run into the reports. We cannot leave the default of 24 hours, as this would exclude the weekend’s events. So change the “Report Type” option to “From last run till now” as seen below.


Figure 9: Setting Report Options form

Click “OK” to apply the setting.

12. Lastly, click on “Schedule Options” to set a schedule. As long as no schedule is set, no reports will be generated automatically. In our sample, we let MoniLog generate reports each working day at 8:00 in the morning. Weekends are not enabled. The dialog looks like this:


Figure 10: Configuring report generation schedule

13. Click on “OK” to apply the settings.The MoniLog service has not yet been started. It generates the scheduled reports (so you don’t need to run the client in foreground).

14. To conclude your configuration of MoniLog, start the service. To do so, select “Service”, then “Start Service” from the menu. This will start the service. During setup, the service is set to start automatically with system startup. So there is no need to manually restart the service after a reboot.

MoniLog is now completely configured. You will not immediately receive reports, because they will only be generated at 8am each working day. So you need to wait for the next morning. If you would like to change the schedule to have an immediate feedback, please go to “Schedule” and change the time to be a few minutes in the future. Then click “OK” and restart the service. This can be done via the “Service” menu. A restart is necessary because the service reads changed parameters at startup, only.

Please Note: The only difference between configuring your reports to be generated either from Log Files or on underlying database is Step 2. From Step 3 onwards settings are the same.

You are done!

Well, this is all you need to do to configure the basic operations. Once you are comfortable with the basic setup, you can enhance the system with local pre-filtering of event, enhanced logging and alerting (with MonitorWare Agent) and changing report options (with MoniLog / MonitorWare Console).

What is recommended setting for MoniLog and Why?

Let’s quote Rainer Gerhards, design lead for the overall MonitorWare line of products, here:

Typically, MoniLog should work with Log Files, and not with the database. As using files is the recommended way with MoniLog. Why is it recommended? Because it is much faster! Why do we support database, too? Because this allows easier integration e.g. with the Web Interface! Would I recommend MoniLog and database if a customer also needs to run the Web Interface? In most cases: No! From a performance point of view its better to create both text files and database content.

Creating a simple Syslog Server

Posted on by

Last updated 2016-08-26 by Jan Gerhards, using Winsyslog 13.2.

In this scenario, a simple Syslog server will be created. No other services are configured. The Syslog server will operate as a standard Syslog server on the default port of 514/UDP. All incoming data will be written to a single text file.

Step 1 – Defining a Rule Set for File Logging

The rule set specifies what action to carry out. You might be tempted to define the service first, but starting with the rule set makes things easier as it will be already present when the service is defined later and needs to be bound to a rule set.

To define a new rule set, right click “RuleSets”. A pop up menu will appear. Select “Add Rule Set” from this menu. On screen, it looks as follows:

Then, a wizard starts. Change the name of the rule set to whatever name you like. We will use “Write Syslog Log File” in this example. The screen looks as follows:

After that, select “Add a Rule for each of these Actions”. You should then be able to change settings in the before greyed-out area. There, select “File Logging” (subitem of “Storing Actions”). Your screen should now look like this:

After that, click “OK” and the wizard will close. The client will now show a newly created rule set.

As you can see, the “Write Syslog Log File” rule set is now present. Please expand it in the tree view until you have the following screen contents:

As you can see, we have a “File” action configured. We will review the settings just for your information. Click on “Filters”:

As you can see, none of the filter conditions are enabled. This means that the all information units (incoming messages) will be matched by these filter conditions. As such, the rules for the “File Logging” action will always be carried out for all messages.

Please note that this also means that all Syslog priorities and facilities will be written to the same file.

Now let us check the “File” action itself. Please select it in the tree view:

As you can see, it has been created with the default parameters. Each day, a file will be created in the C:\temp directory and its base name will be MonitorWare (meaning the name of the generated file will be MonitorWare-*date*, i.e. “MonitorWare-2016-08-26.log”). It will include all information items in the file (you can select the information items that will be in the file by scrolling down and ticking the boxes).

If you would like to store it into a separate directory or change the file name, here is the place to do it. Important: please make sure the directory you specify exists! If it does not yet exist, please create it before you start the service. If the directory does not exist, the service is not able to store any files.

In our example, we would like to save it to “C:\logfiles” with a base name of “Syslog”. Therefore, we change these properties.

After doing so, please remember to save your changes. To do so press “Save” (upper left corner).

Now you have a useable rule set for logging incoming messages to a text file.

Step 2 – Create a Syslog Server Service

Now we need to define a Syslog server service. A Syslog server is also sometimes called a “Syslog daemon”, “Syslogd” or “Syslog listener”. It is the process that receives incoming messages.

To define it, right click on “Services”, then select “Add Service” and the “Syslog Server”:

Once you have done so, a configuration pane opens.

Also, you will see a newly created service beneath the “Services” part of the tree. View and can rename it if you want (in this example, we will name it “My Syslog Server”). After this, press save.

Your screen should now look like this:

As you can see, the service has been created with the default parameters. As such, it operates as a RFC compliant standard Syslog server.

Please note that the “Write Syslog Log File” has been automatically assigned as the rule set to use. This is the case because we already created it and it is the only rule set. If another one is to be used, you can change it to another ruleset here (you might have to scroll down to view the option):

This procedure completes the configuration of the Syslog server.

Step 3 – (Re-) Start the Service

The application cannot dynamically read changed configurations. As such, it needs to be restarted after such changes. In our example, the service was not yet started, so we simply need to start it. If it’s already running, you need to restart it.

Service control can be done with both the respective operating system capabilities or with the configuration client. These are highlighted in the screenshot below:

The buttons resemble Windows service manager – start, stop and restart. In this example, stop and restart are grayed out because the service is not running.

After service restart, the new definitions are active and the application is ready to accept and store incoming messages.

Step 4 – Configure your Syslog-Enabled Devices

Even though application is now ready, it can only receive messages if some devices send them. Remember, Syslog is a protocol where the server is passively waiting for incoming messages. As long as no device sends message, the Syslog server will not log anything.

Since there are a large variety of devices, we unfortunately cannot provide device specific instructions. However, almost all devices need to be configured with their specific configuration tool. Typically, only two settings need to be made: one to activate Syslog messages at all and one with the Syslog server IP address or name.

Remember: the computer running application now acts as a Syslog server. As such, you need to find out its IP address or name and supply it to the device as the Syslog server. Please note that not all devices can operate with computer names. Use the IP address, if in doubt.

How To setup Database Logging Action

Posted on by

1. Start the Application.

2. Again, you can select the language to use. And again, I suggest using English, as this makes the guide easier to follow.

3. Then define a new rule set, right click “Rules”. A pop up menu will appear. Select “Add Rule Set” from this menu. On screen, it looks as follows:

4. Then, a wizard starts. Change the name of the rule to whatever name you like. We will use “Database Logging” in this example. The screen looks as follow:

Click “Next”. A new wizard page appears as appeared in the case of EventReporter. Select only Database Logging here. Do not select any other options for this example. Also, leave the “Create a Rule for each of the following actions” setting selected. Click “Next”. You will see a confirmation page as showned in the case of EventReporter and there you have to click Finish.

5. After above steps you will see that the new Rule Set “Database Logging” is present. Please expand it in the tree view until the action level of the “Database Logging” Rule and select the “Database Logging” action to configure.

6. Now click on the Data Sources (ODBC) button to open the ODBC Data Source Administrator. Then choose the “System DSN” tab and click the “Add” button to add a new System-DSN (Select the Microsoft Access driver like in the screenshot below).

8. In the next step, click the “Select button” and go to the application installation directory (Usually C:\program files\instalationfolder\) and choose the sample database called sample97.mdb. After that name the new DSN with “MyDatabaseDSN” like in the following screenshot and press OK.

9. Now close the ODBC Data Source Administrator and switch back to the application client and insert “MyDatabaseDSN” in the DSN field. Leave all other settings in their default and save the changes.