What’s New in Syslog Watcher 7

The syslog collector is now a separate Windows service, independent of Syslog Watcher Server and Manager. Incoming messages are written to storage even while the Server is stopped — for example during an upgrade.

See Syslog Collector.

The new storage layout handles higher message rates than version 6.5 and handles time zones better.

See Syslog Storage.

Manager can connect over the network to a Syslog Watcher Server to configure it, view stored messages, and work with reports. The connection can be encrypted. Role-based accounts can be limited to read-only access, with no permission to change the configuration.

See Remote Access.

The Storage tab shows how many messages arrived each hour and day, by originator and severity. Use it to find when and where a problem started.

See Storage Overview.

View tabs keep their request and layout when Manager restarts.

See View/Search Messages.

The message grid has a filter row: each column can be filtered on its own.

View/Search presets save frequently used searches and open them in one click.

See View/Search Presets.

Parsers are redesigned: they have more section types, and the editor has live testing. Built-in parsers cover Cisco, Fortinet, Juniper, NETGEAR, Palo Alto, SonicWall, Sophos, and Ubiquiti.

See Syslog Parsers.

Many vendors do not put field names in the syslog text; the payload is only a list of values. A field collection names those values by message type, so they can be used in filters, exports, and views.

See Field Collections.

New field modifiers extract and transform message data, and new escape modifiers prepare values for CSV, JSON, SQL, HTML, URLs, command lines, and file names. Escaping keeps special characters in syslog text from breaking those outputs.

You can rename severities and facilities; the syslog numbers stay the same.

See Severity and Facility Names.

A new regular expression engine makes filters, field extraction, and parsers faster. Existing expressions do not have to be rewritten.

The incoming filter still discards traffic before storage by severity and keywords. It now also accepts a regular expression on the raw line, as an allow-list or a deny-list.

See Incoming Filter.

The Server has a certificate store that generates, imports, and exports certificates. TLS settings select a certificate by name instead of a file path.

See TLS Certificates.

The collector records the certificate fingerprints and names of new TLS clients. Allow a client by checking its entry in the list, instead of copying values by hand.

See Client Certificate Validation.

A built-in test measures how fast a disk can write syslog storage. Use it to estimate hardware requirements.

See Test Storage Speed.

Each feature can be suspended and resumed. On resume, a feature continues from where it stopped (including the backlog), skips to new messages, or starts from a chosen date and time. New features start suspended, so nothing is exported until you click Resume.

See Managing Features.

A new feature type starts a program or script for each matching message, with message fields on the command line.

See Execute Program/Script.

A new feature type sends an HTTP request (POST or PUT) for each matching message. Named HTTP endpoints hold the host, TLS, headers, and authentication; the feature supplies the path and the body, including JSON.

See Send HTTP Requests.

Reports can run on a schedule: once, recurring, weekly, or monthly. The Server generates them without Manager running; open the results in Manager later.

See Syslog Reports.

Passwords and other private values are stored as encrypted secret strings and referred to as %Name% in the configuration.

See Secret Strings.

The storage archive keeps a compressed, optionally encrypted copy of the storage, daily or hourly, in a local or network folder. A command can run after each sync — for example to copy the archive to cloud storage.

See Storage Maintenance and Archive.

The Server can email new warnings and errors from its own and the collector’s diagnostic records, so you can fix problems before they stop collection or leave gaps in the log.

See Server Diagnostics.

Syslog Watcher 7 migrates a version 6 installation on the same computer: license, configuration, forwarders (as features), knowledge-base files, filter lists, view layouts, and report templates. It keeps using the version 6 syslog storage, so existing messages are not copied.

See Migrate from Version 6.