Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm looking for a way to safely centralize all my Windows and Linux logs on one location. Since I'm in a mixed environment, with both Linux and Windows, I started using Syslog-ng on the Linux boxes and Snare on the Windows ones, all pointing to a syslog-ng on linux.

Playing with the system, I realised that any network failure would cause the Windows event to be lost (Snare only use udp with syslog), so i tried WinAgents, with the same results

I tried switching to a Kiwi Syslog Server, and tried both Syslog and SNMP protocol on the WinAgents, with the same result.

Since both Kiwi and Syslog-ng can listen on TCP ports, there should be some Windows syslog client using tcp, right? Does anyone have any experience on such clients ?

Many thanks

Edit : I've been trying Centreon E2S, that supports both UDP and TCP, but does not seems to resend the message when there is a network failure


locked by HopelessN00b Mar 13 '15 at 14:07

This question exists because it has historical significance, but it is not considered a good, on-topic question for this site, so please do not use it as evidence that you can ask similar questions here. This question and its answers are frozen and cannot be changed. More info: help center.

closed as off-topic by HopelessN00b Mar 13 '15 at 14:07

This question appears to be off-topic. The users who voted to close gave this specific reason:

If this question can be reworded to fit the rules in the help center, please edit the question.

up vote 2 down vote accepted

You'll have to fork over some cash, but syslog-ng's "premium edition" has a Windows agent (see here)


Take a look at nxlog, it supports TCP and SSL too. It's open-source and works on both Linux and Windows.

Thank you, I'll have a look at it ! – Nicolas Charles Nov 5 '11 at 20:32

I haven't used it, but it looks like the Adiscon EventReporter application will do what you're looking for.


We're using LogZilla ( with our windows boxes. The windows systems use Snare to forward logs to our LogZilla server. We like it because it is blazing fast for searches and charts (and we log over 100 million events a day), plus it costs WAYYYY less than Clunk (splunk) and the user interface is easy enough for our managers to use, lol.


I got it working using Kiwi in combination with STunnel.

  • Set kiwi up to forward using Http to a certain port on localhost
  • Set stunnel up to listen to that port and forward to your syslog server

The stunnel config would be something like:

client = yes
accept =
connect =

where would be the ip:port of your syslog server (and kiwi would be forwarding to localhost:1234).

Still looking for a replacement for Kiwi/SolarWindsLogForwarder for Windows though... It must send Http instead of UDP to work correctly with stunnel.


protected by Iain Feb 6 '12 at 19:17

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.