Windows Service

The collector runs as its own Windows service (Syslog Watcher 7 Collector, SW7Collector), separate from Manager and from Syslog Watcher 7 Server. Start, stop, and startup type can be changed from Manager, from Windows Services, or from an Administrator command prompt.

Starting and Stopping the Collector

Using Syslog Watcher Manager

On the Server toolbar, click Collector → Start Syslog Collector or Stop Syslog Collector.

Server toolbar — Collector menu showing Start/Stop Syslog Collector and Startup Type options

Using Windows Services

  1. Open the Services application (Start → Windows Administrative Tools → Services).

  2. Locate Syslog Watcher 7 Collector in the list.

  3. Click Start or Stop.

Using Command Prompt

Open Command Prompt as Administrator:

net start SW7Collector
net stop  SW7Collector

Startup Type

The startup type controls whether the collector service starts automatically when Windows boots.

Startup Type Behavior

Automatic

Starts with Windows. Usual setting for a production collector.

Manual

Does not start with Windows. Start it from Manager or Windows Services when collection is needed.

Disabled

Cannot be started until the startup type is changed.

Changing the Startup Type

From Syslog Watcher Manager:

  1. On the Server toolbar, click Collector → Startup Type.

  2. Select Automatic, Manual, or Disabled.

The change takes effect immediately and persists across reboots.

Alternatively, change it from Windows Services:

  1. Open Services, locate Syslog Watcher 7 Collector.

  2. Double-click to open its Properties.

  3. Under Startup type, select the desired option.

  4. Click OK.

Running Under a Service Account

The collector service runs as Local System, which is enough when syslog storage is on a local disk.

Use a dedicated domain account when:

  • The syslog storage is on a network share — Local System typically has no access to network paths.

  • The storage path requires specific NTFS permissions that Local System does not have.

  • A security policy requires a named service account.

Changing the Service Account

  1. Open the Services application.

  2. Double-click Syslog Watcher 7 Collector to open its Properties.

  3. Go to the Log On tab.

  4. Select This account and enter the domain account credentials.

  5. Click OK.

  6. Restart the collector service for the change to take effect.

The service account must have Read and Write permissions on the syslog storage directory (and all its subdirectories). Grant permissions using Windows Explorer → folder properties → Security tab, or via icacls from the command line.

Related Topics