Monitoring Features

The live status of features is on the Server tab in Manager. Click Server Features in the diagram to show the Features table. To change or control features, use the Server Features window.

The table lists only active features. If the Syslog Watcher Server service is stopped, the table shows Syslog Server is stopped.

Features Table

Status	Processing, Suspended, or Failed with the time since the current failure started (Failed … ago).
Name	Feature name.
Type	Feature type, such as Export to Files or Send Emails.
Last Timestamp	Time of the last syslog message the feature processed successfully.
Messages	Number of messages the feature has processed successfully.
Errors / Recoveries	Number of failures, and number of times the feature recovered from a failure. While the feature is failing, the numbers are red and show when it retries next (retry in …). For a suspended feature the column shows —.

A second row under a feature shows its last error:

Last error [time]: … — the feature is running or retrying.
Initialization failed [time]: … — the feature could not start, for example because of a missing setting, and the server suspended it.

Reading the Status

Status	Meaning
Processing	The feature is running. Messages grows when matching messages arrive in storage.
Suspended	The feature is loaded but does not read storage. It was suspended, is new, or failed to start (see the error row).
Failed	Reading storage or sending to the destination failed. The feature retries the same message automatically: first after a short delay, then at a longer interval.

Status

Meaning

Processing

The feature is running. Messages grows when matching messages arrive in storage.

Suspended

The feature is loaded but does not read storage. It was suspended, is new, or failed to start (see the error row).

Failed

Reading storage or sending to the destination failed. The feature retries the same message automatically: first after a short delay, then at a longer interval.

Troubleshooting

Symptom	Likely cause
Feature not in the table	Active is No, or the server is stopped. Check the feature in Server Features.
Messages stays at 0 after resume	The filter matches nothing, or the feature was resumed From Now and no new matching messages arrived.
Suspended with Initialization failed	A required setting is missing or invalid, such as the email account or HTTP endpoint. Fix the setting, then resume the feature.
Failed	Read the error row to see what failed.
Errors / Recoveries keeps growing	The destination (mail server, database, syslog server, HTTP endpoint) is unstable. Fix the destination; the feature then catches up from storage.
Collector counters grow, Messages does not	The feature is suspended, its filter excludes the messages, or it is failing (see Failed).

Symptom

Likely cause

Feature not in the table

Active is No, or the server is stopped. Check the feature in Server Features.

Messages stays at 0 after resume

The filter matches nothing, or the feature was resumed From Now and no new matching messages arrived.

Suspended with Initialization failed

A required setting is missing or invalid, such as the email account or HTTP endpoint. Fix the setting, then resume the feature.

Failed

Read the error row to see what failed.

Errors / Recoveries keeps growing

The destination (mail server, database, syslog server, HTTP endpoint) is unstable. Fix the destination; the feature then catches up from storage.

Collector counters grow, Messages does not

The feature is suspended, its filter excludes the messages, or it is failing (see Failed).

Monitoring Features

Features Table

Reading the Status

Troubleshooting

Related Topics