Monitoring Features

Live feature status is on the Server tab in Syslog Watcher Manager, in the Features table. Configuration and start/stop of workers is in Server Features; the Server tab is the dashboard.

The table lists only active features (Active = Yes). Inactive features are omitted.

If the Syslog Watcher Server service is stopped, the table shows Syslog Server is stopped. Features do not run without the server, even if the collector is still writing to storage.

Server Tab Columns

Column Description

Status

Badge: Processing (running), Suspended (idle), or Failed plus how long the current failure has lasted.

Name

Feature name.

Type

Feature type (Export to Files, Send Emails, and so on).

Last Timestamp

Time of the last syslog message the feature successfully committed.

Messages

Count of messages consumed (committed by the exporter).

Errors / Recoveries

How many error streaks have started vs how many times processing resumed after an error.

A second row under a feature appears when there is an error message:

  • Last error [timestamp]: … — while the worker is running or retrying

  • Initialization failed [timestamp]: … — the feature could not start and was auto-suspended

Reading the Status

Status What it means

Processing

Worker is running. Messages should increase when matching traffic is in storage.

Suspended

Loaded but not reading storage. It was suspended, just created, or initialization failed (check the error row).

Failed

Export, flush, or storage read failed. The server retries automatically (short delay first, then a longer interval).

What to Check When Something Looks Wrong

Symptom Likely cause

Feature missing from the Server tab

Active = No, or the server is stopped. Open Server Features.

Messages stays at 0 after resume

Filter matches nothing, or resume was From Now and skipped backlog.

Failed

Read the error details in Status to see what is wrong.

Errors / Recoveries climbing

Destination is flapping (mail server, DB, downstream syslog, HTTP). Fix the destination; recoveries should catch up.

Collector counters rise, feature Messages does not

Feature is suspended, filter excludes the traffic, or the exporter is failing (see Failed).

Related Topics