Troubleshooting

All counters in Monitoring are 0

Collector not running

Start the collector: Server toolbar → Collector → Start Syslog Collector, or start the Windows service from services.msc. See Windows Service.

Received = 0 on a specific interface

No messages arriving on that interface

Verify the originator is sending to the correct IP address and port. Confirm the interface is configured and enabled in Network Interfaces. Check whether Windows Firewall is blocking the port (see below).

Received = 0, collector running, port conflict error in Diagnostic Records

Another service is using the configured port (Error 10048)

Identify the conflicting process (netstat -ano or Get-NetUDPEndpoint in PowerShell), then either stop it or change the collector’s port in Network Interfaces.

Received = 0, no errors in Diagnostic Records

Windows Firewall blocking inbound UDP/TCP traffic on the syslog port

Create an inbound firewall rule for the port in Windows Defender Firewall. For UDP 514: netsh advfirewall firewall add rule name="Syslog UDP 514" dir=in action=allow protocol=UDP localport=514

Received > 0 but messages are not visible in the message list

Incoming Filter is discarding all messages

Review the Incoming Filter settings. The filter may be set to a severity threshold that excludes those messages, or to an allow-list keyword that does not match.

Dropped counter > 0

Memory buffer overflow — messages are arriving faster than storage can write them

Increase the buffer size in Memory Buffer. If the Dropped counter keeps growing, address the storage bottleneck (see below).

Buffered counter growing continuously

Storage write throughput too low

Move syslog storage to a local SSD. Avoid network shares. See Performance for tuning recommendations.

Buffered counter non-zero but stable

Normal burst absorption

No action required. The buffer is absorbing bursts. Watch it at peak traffic; it should not keep growing.

Filtered counter unexpectedly high

Incoming Filter is discarding more messages than intended

Review Incoming Filter settings. Check whether the severity threshold or keyword rules are broader than expected.

TLS handshake failure in Diagnostic Records

Incomplete or incorrect server certificate chain

The certificate chain in the PEM file must start with the server certificate, followed by any intermediate CAs, ending at the root CA. See Syslog over TLS for chain requirements.

Client connection rejected, fingerprint logged in Diagnostic Records

Client certificate not in the fingerprint file

Copy the fingerprint from the Diagnostic Records entry and add it to the certificate fingerprints file. See Certificate Fingerprints.

TLS handshake failure, version-related error

Originator using a TLS version below the configured minimum

Lower the Minimum protocol version in the TLS interface options. The initial value is TLS 1.2; TLS 1.0 and 1.1 are deprecated and should be avoided where possible. See TLS Options.

Encrypted messages not arriving despite correct TLS configuration

Originator CA certificate not trusted

If using CA file validation, the originator’s issuing CA must be in the CA file. See Syslog over TLS.

Collector fails to start

Error during initialization

Open Diagnostic Records and use the first Error in the session (port conflict, storage path, license — see rows below).

Failed to create interface …​ Error 10048

Port conflict at startup

Another service already bound to the port. Identify it with netstat -ano and stop it, or change the collector port in Network Interfaces.

Storage initialization error in Diagnostic Records

Storage path does not exist or is not writable

Verify the syslog storage path. If the path is on a network share, ensure the collector service account has write access. See Running Under a Service Account.

License error in Diagnostic Records

License activation problem

Check the license status message in Diagnostic Records. See License Management.

Collector starts then stops immediately

Fatal error during initialization

Open Diagnostic Records and check the Prev. Records button to compare with the last successful session. Save the records and contact support.