Collector Service
The collector runs as its own Windows service, Syslog Watcher 7 Collector (SW7Collector), separate from Manager and from Syslog Watcher 7 Server (SW7Server).
Starting and Stopping the Collector
Start or stop the collector in one of these ways:
-
► In the Server section of the main toolbar, click
Collector → Start Syslog Collector or Stop Syslog Collector. -
► When the collector is stopped, click Start Collector on the Server tab.
-
► In Services (
services.msc), select Syslog Watcher 7 Collector and click Start or Stop. -
► In a Command Prompt run as Administrator, run
net start SW7Collectorornet stop SW7Collector.
The Start, Stop, and Startup Type commands appear in the Collector drop-down only when you can control the collector:
-
► Local server: always. Manager runs as Administrator and asks for elevation when it starts.
-
► Remote server: only for the Admin role (see Remote Access).
Startup Type
The installer registers the collector with startup type Automatic, but does not start it. Start it once after the initial configuration; after that it starts with Windows.
To change the startup type, click
Collector → Startup Type: <current> → Switch to Manual or Switch to Automatic.
| Startup type | Behavior |
|---|---|
Automatic |
Starts with Windows. Usual setting for a production collector. |
Manual |
Does not start with Windows. Start it from Manager or Windows Services when collection is needed. |
Automatic (Delayed Start) can be set in Windows Services; Manager shows it as Automatic.
Recovery After a Failure
If the collector service stops unexpectedly, Windows restarts it after the first and the second failure. After a third failure within one hour, it stays stopped.
After an unexpected restart, open Diagnostic Records and check the records of the run that failed.
Storage Location
The collector writes to syslog storage, which must be on a local disk. Network folders (mapped drives and UNC paths) are rejected as a storage location.
To keep a copy of collected messages on a network or cloud location, use the storage archive.
Related Topics
-
Diagnostic Records — startup and shutdown events
-
Monitoring — collector status on the Server tab
-
Syslog Server — the other Syslog Watcher service