Troubleshooting

Collector status Stopped

Collector service not running

Click Start Collector on the Server tab, or Collector → Start Syslog Collector in the Server section of the main toolbar. See Collector Service.

Status Not Collecting, reason No network interfaces in the collector configuration.

No listener configured

Add one in Network Interfaces.

Interface row in red: Another service or application uses this protocol/network address/port.

Another program already uses the address and port

The error names the program after Occupied by:. If it does not, find the program with netstat -ano, or with Get-NetUDPEndpoint / Get-NetTCPConnection in PowerShell. Stop it, or change the port in Network Interfaces. The collector retries every 5 seconds, so the interface starts once the port is free.

Interface Messages = 0, no errors

Traffic does not reach the collector

Check that the originator sends to this computer’s IP address, the same port, and the same transport (UDP vs TCP). Allow the port in Windows Defender Firewall, for example:
netsh advfirewall firewall add rule name="Syslog UDP 514" dir=in action=allow protocol=UDP localport=514

Interface Messages > 0, but nothing in views

Messages are discarded, or the view filters them out

Check Discarded Messages. If nothing is discarded, check the view’s time range and filter.

License limit

The license limit on originators or messages per hour is reached. The Free License allows 3 originators and 5000 messages per hour. See License Management.

Filtered (content) / Filtered (severity) higher than expected

Review the Incoming Filter. Matching is case-sensitive and includes the syslog header. With If message matches set to Accept it, messages that do not match the regular expression are discarded.

Unknown originator

If originator ID is unknown is Discard messages. Add the originator manually in Syslog Originators, or switch the setting to Add new originator.

Inactive originator

Set Active to Yes on that originator.

No originator ID

An IP range rule cannot extract the ID from these messages. Fix the rule, or set If unable to extract ID to Apply the default rule.

Storage failure

A new originator could not be registered in syslog storage. Read the Failed to register syslog originator record in Diagnostic Records. Check free disk space and permissions on the storage folder.

Buffer overflow

Messages are not written to storage fast enough, or not at all. If writes fail (disk full, storage folder unavailable), the collector keeps retrying and the buffer fills up; check Diagnostic Records. If storage is too slow: for bursts, increase Buffer size (messages) in Memory Buffer; for sustained load, see Performance.

Start Syslog Collector fails

The configuration cannot be loaded, or another error during startup

Open Diagnostic Records and read the first Error of the latest collector run.

The collector runs but stores nothing; Diagnostic Records show Collector started without syslog storage; not accepting syslog.

Storage folder missing or not accessible

Check the path in Syslog Storage, then restart the collector.

Diagnostic Records show [License] Failed to load license; License limit discards

The license file cannot be loaded; the collector uses the Free License limits

See License Management.

Collector stops unexpectedly

The collector failed while running

Windows restarts it; see Recovery After a Failure. Compare with the last good run (Prev. Records), click Save to File…​, and contact technical support.