Logscape Support

Members Login
Username 
 
Password 
    Remember Me  
Logscape Support -> logscape -> syslog issues on UDP 1514
Post Info TOPIC: syslog issues on UDP 1514
goran_j


Newbie

Status: Offline
Posts: 4
Date:
syslog issues on UDP 1514
Permalink  
 

Hello,

we are testing Logscape 3 as an alternative to Splunk and it all works except for Syslog on port 1514. We are running version (Logscape-3.0_b0826-x64) on Windows server.

Syslog seems to be running on TCP 1468, when i send data to the server using that port i see a lot of activity in syslogserver.log but when i try sending data using UDP1514 there is no activity in the syslogserver.log.

I have modified boot.properties by adding -Dsyslog.tcp.port=1468 -Dsyslog.udp.port=1514 and have disabled all firewalls. After bouncing agent there are two entries in the Syslog panel: Startup_Test message level:INFO and Startup test message level:ALERT

syslogserver.log and boot.log both indicate that syslog has started and is running on both ports i just cannot reach it on 1514.

I have tried collecting data from ESXi, CentOS, Cisco and Xen machines. there is not much i can configure on some of those devices so it makes me think that issue lies with my configuration of management server.

Any suggestion would be greatly appreciated.

Thank you,

goran 

 



__________________
Nathen


Member

Status: Offline
Posts: 23
Date:
Permalink  
 

Hi Goran,

When using a tool such as Wireshark do you see UDP data arriving on port 1514?

We need to pin whether it is an issue with how the data is being processed when it arrives, or an issue with sending/receiving.

Thanks,
Nathen

__________________
goran_j


Newbie

Status: Offline
Posts: 4
Date:
Permalink  
 

Hi Nathen,

Thank you for your suggestion. I ve changed boot.properties to -Dsyslog.udp.port=514

and data started showing up which is great.
I don't know if this is something that I should address but every 5-10 seconds there is a following entry in syslogserver.log

2015-09-25 11:48:43,165 INFO SyslogServer: udp (handler.ContentFilteringLoggingHandler)  WorkingDir:C:\Logscape 3.0 (64 bit)\logscape\system-bundles\vs-syslog-server-1.0\.
2015-09-25 11:48:43,167 INFO SyslogServer: udp (handler.ContentFilteringLoggingHandler)  Loading MappingFile from ClassPath
2015-09-25 11:48:43,173 INFO SyslogServer: udp (handler.PerAddressHandler)  Client:Socket Action:ConnectionEstablished Address:10.1.44.202
2015-09-25 11:48:47,702 ERROR SyslogServer: udp (handler.MultiplexerHandler)  Failed
java.lang.NullPointerException
 at com.liquidlabs.syslog4vscape.handler.MultiplexerHandler.event(MultiplexerHandler.java:69)
 at org.productivity.java.syslog4j.server.impl.AbstractSyslogServer.handleEvent(AbstractSyslogServer.java:288)
 at org.productivity.java.syslog4j.server.impl.AbstractSyslogServer.handleEvent(AbstractSyslogServer.java:271)
 at org.productivity.java.syslog4j.server.impl.net.udp.UDPNetSyslogServer.run(UDPNetSyslogServer.java:86)
 at java.lang.Thread.run(Unknown Source)

Or should we ignore it? everything seems to be running fine on port 514.

Goran



__________________
neilson9


Senior Member

Status: Offline
Posts: 100
Date:
Permalink  
 

Thanks Goran - I thought this issue had been resolved. A new release is due this week which will stop the exception from occurring.


__________________
Page 1 of 1  sorted by
 
Quick Reply

Please log in to post quick replies.
Logscape Support -> logscape -> syslog issues on UDP 1514


Create your own FREE Forum
Report Abuse 		Powered by ActiveBoard