i'm using kiwi syslog daemon version 6.3.6 and backlog on many nt 4.0, sp6
servers and encountered the same problem you describe with some of my more
fairly busy servers. ymmv, but i found that disabling the native nt 4.0
snmp and snmp trap service eliminated the problem. i never got around to
testing this (e.g. generating mass amounts of snmp events and event log
entries in an attempt to crash backlog) but there appeared to be some sort
of contention between the two. if someone can shed some light on this i'd
be very interested to hear why. lastly, because snmp events on nt are
typically also logged to the eventlog, you'll see these entries via backlog
who'll dutifully report them to your syslog system.

cheers,

~g

> -----Original Message-----
> From: Kenneth Lorenzo [SMTP:KLorenzoctnet.com]
> Sent: Monday, April 08, 2002 8:50 AM
> To: 'H C'; focus-mssecurityfocus.com
> Subject: RE: Using syslog clients
>
> do you have some sort of filtering for ip addresses on the syslog daemon
> you're running? Ive used backlog before although it gets buggy when you
> have
> a lot of events being sent out from the server. You'll get out of memory
> resources once in a while...
>
> -----Original Message-----
> From: H C [mailto:keydet89yahoo.com]
> Sent: Friday, April 05, 2002 6:24 AM
> To: focus-mssecurityfocus.com
> Subject: Using syslog clients
>
>
> I'm using a couple of test systems to determine the
> suitability of converting NT/2K EventLog to syslog.
>
> I've used Kiwi's Syslog Daemon before, and have that
> running on a system. I've installed BackLog on one
> test system, and NTSyslog on another.
>
> When I installed the syslog clients, I first backed up
> and cleared the EventLogs, then installed and
> activated the clients. However, the EventLogs on both
> test clients have received new entries, and they
> aren't being sent to the syslog server.
>
> Does anyone have any thoughts as to why? Neither
> client came with detailed installation instructions.
>
> Thanks
>
> __________________________________________________
> Do You Yahoo!?
> Yahoo! Tax Center - online filing with TurboTax
> http://taxes.yahoo.com/

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]