Quick Start

Step 1: Install

  1. Download the latest release from ezfive.com/syslog-watcher/downloads/.

  2. Run the Syslog Watcher 7 installer and accept the license agreement.

  3. On the Choose Components page, select the components and the installation folder:

    • Syslog Watcher Server — the Collector and Server Windows services.

    • Syslog Watcher Manager — the desktop application.

  4. Finish the installation.

To manage a remote server from a workstation, install only Syslog Watcher Manager.
After installation, depending on the selected components

  • Program files are in C:\Program Files\Syslog Watcher 7\ (or the folder chosen at install).

  • Syslog Watcher 7 Server (SW7Server) and Syslog Watcher 7 Collector (SW7Collector) are registered as Windows services that start automatically with Windows.

  • Windows Firewall gets inbound allow rules for both services, so originators and remote Managers can connect. Another firewall on this computer or in the network needs its own rules.

  • Work files are in C:\ProgramData\SyslogWatcher7\.

  • Syslog storage is in C:\ProgramData\SyslogStorage7\.

  • Manager keeps its preferences and current state for each Windows user in C:\Users\<user>\AppData\Roaming\SyslogWatcher7\.

Step 2: Open Manager

Start Syslog Watcher 7 Manager from the Start menu or the desktop shortcut. Manager connects to the local Syslog Watcher server.

Step 3: Migrate from Version 6 (if present)

If Syslog Watcher 6 data is on this computer, the Migrate from Syslog Watcher 6 window opens. Follow Migrate from Version 6: test, migrate, and turn storage retention back on.

Step 4: Check Network Interfaces

A new installation listens for UDP on all IPv4 addresses (0.0.0.0), port 514. Most network devices send syslog to this port by default.

To add TCP, TLS, or more UDP listeners, see Network Interfaces.

Step 5: Start the Collector

The installer does not start the collector, so you can review its settings first. Start it in one of these ways:

  • ► In the Server section of the main toolbar, click Collector Collector → Start Syslog Collector.

  • ► On the Server tab, click Start Collector under Syslog Collector in the diagram.

Step 6: Point Devices at This Computer

Configure each network device, server, workstation, or software source to send syslog to this computer’s IP address and the port from Step 4.

Each new sender is added as an originator when its first message arrives.

Step 7: Check That Messages Arrive

  1. In Manager, select the Storage tab.

  2. Click Refresh symbol Refresh; today’s counts grow as messages arrive.

  3. Click a count to see those messages in a view tab.

If no messages arrive, see Collector Troubleshooting.

Work Without Internet Access

Syslog Watcher does not need Internet access to collect, store, and view syslog messages, so it can run in a closed network. For the tasks that involve EZ5, use another computer or a phone with Internet access:

  • License: install a license or request an evaluation license with a request link or a QR code. See Offline Installation.

  • User Guide: install the offline User Guide, so that Help opens pages from disk.

  • Updates: download the new installer on another computer, copy it over, and run it.

  • Support: save the support data file and attach it to a ticket from another computer.

Related Topics