Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm looking for a way to safely centralize all my Windows and Linux logs on one location. Since I'm in a mixed environment, with both Linux and Windows, I started using Syslog-ng on the Linux boxes and Snare on the Windows ones, all pointing to a syslog-ng on linux.

Playing with the system, I realised that any network failure would cause the Windows event to be lost (Snare only use udp with syslog), so i tried WinAgents, with the same results

I tried switching to a Kiwi Syslog Server, and tried both Syslog and SNMP protocol on the WinAgents, with the same result.

Since both Kiwi and Syslog-ng can listen on TCP ports, there should be some Windows syslog client using tcp, right? Does anyone have any experience on such clients ?

Many thanks

Edit : I've been trying Centreon E2S, that supports both UDP and TCP, but does not seems to resend the message when there is a network failure

share|improve this question
add comment

5 Answers 5

up vote 2 down vote accepted

You'll have to fork over some cash, but syslog-ng's "premium edition" has a Windows agent (see here)

share|improve this answer
add comment

I haven't used it, but it looks like the Adiscon EventReporter application will do what you're looking for.

share|improve this answer
add comment

Take a look at nxlog, it supports TCP and SSL too. It's open-source and works on both Linux and Windows.

share|improve this answer
    
Thank you, I'll have a look at it ! –  Nicolas Charles Nov 5 '11 at 20:32
add comment

We're using LogZilla (http://www.logzilla.pro) with our windows boxes. The windows systems use Snare to forward logs to our LogZilla server. We like it because it is blazing fast for searches and charts (and we log over 100 million events a day), plus it costs WAYYYY less than Clunk (splunk) and the user interface is easy enough for our managers to use, lol.

share|improve this answer
add comment

I got it working using Kiwi in combination with STunnel.

  • Set kiwi up to forward using Http to a certain port on localhost
  • Set stunnel up to listen to that port and forward to your syslog server

The stunnel config would be something like:

[Syslogs]
client = yes
accept = 127.0.0.1:1234
connect = 1.2.3.4:5678

where 1.2.3.4:5678 would be the ip:port of your syslog server (and kiwi would be forwarding to localhost:1234).

Still looking for a replacement for Kiwi/SolarWindsLogForwarder for Windows though... It must send Http instead of UDP to work correctly with stunnel.

share|improve this answer
add comment

protected by Iain Feb 6 '12 at 19:17

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.