KiwiSyslog is not working in my local VMware ESXi lab

[adroit]

I am hoping to have assistance with KiwiSyslog not working in my local VMware ESXi environment.

I have installed the syslog server in application mode successfully on my system. I can generate syslog events using the send test message option from the syslog application as well as sending syslog from PowerShell using a System.Net.Sockets.UdpClient object to create the server and send a test message.

$syslogServer = "localhost"
$syslogPort = 514
$message = "<14>This is a PowerShell syslog message - using localhost"
$encoding = [System.Text.Encoding]::ASCII
$data = $encoding.GetBytes($message)
$udpClient = New-Object System.Net.Sockets.UdpClient
$udpClient.Connect($syslogServer, $syslogPort)
$udpClient.Send($data, $data.Length)

The interesting thing is I can only send a test message from PowerShell when using ‘localhost’ or ‘127.0.0.1’ but if I change the server to use the IP address of the system, the message is never logged.

$syslogServer = "172.21.28.130"
$syslogPort = 514
$message = "<14>This is a PowerShell syslog message - using 172.21.28.130"
$encoding = [System.Text.Encoding]::ASCII
$data = $encoding.GetBytes($message)
$udpClient = New-Object System.Net.Sockets.UdpClient
$udpClient.Connect($syslogServer, $syslogPort)
$udpClient.Send($data, $data.Length)
$udpClient.Close()

The Windows firewall is disabled for the connected network, so this is not impacting syslog.

I have tried using the Kiwi Syslog Message Generator tool v2.2.0, however this results in no syslog messages being received, regardless of whether the target IP address is 127.0.0.1, localhost or the system IP address.

With this behaviour, I am unable to get syslog messages from any other system on the subnet.

I need to use syslog for testing as our software can send data to a syslog, and a lot of customers that we have query syslog functionality. I need to purchase a working version of this so that I can use Secure UDP, however I am unable to get this working using secure on port 514.

I have tried turning off network adapter options such as flow control, IPv4 checksum offload, large send offload, UDP checksum offload with no effect.

Please help troubleshoot why syslog is not able to receive messages when using IP address.

[matt7863 (m@ttshaw)]

Check if it is listening on the server ip address by using ‘netstat -a’ to see if port 514 is listening on 0.0.0.0 (or 172.21.28.130) and not just 127.0.0.1

[adroit]

Hi m@ttshaw. Thanks for your reply. I had confirmed that, and it certainly is listening on UDP 0.0.0.0:514

[adroit]

Does any Spiceworks company Kiwi Syslog engineer have any advice on this? I am not able to proceed with purchasing if the solution is not able to work as expected.

[adroit]

Bump!