Configure TCP input options
By default, Kiwi Syslog Server does not listen for TCP messages, because syslog messages are traditionally sent using UDP.
If any of your network devices send syslog messages using TCP, complete the following steps to enable Kiwi Syslog Server to listen for TCP messages.
- Choose File > Setup to open the Kiwi Syslog Server Setup dialog box.
- Expand the Inputs node.
- Click TCP.
Specify the following options:
Listen for TCP Syslog messages
Select this option to enable Kiwi Syslog Server to receive TCP messages.
The default port for TCP syslog messages is 1468. If you want to listen on a different port for TCP messages, you can enter any port value from 1 to 65535. If you change the port from 1468, the device sending the syslog message must also be able to support the alternate port number.
Bind to address
By default, the TCP socket listens for messages on all connected interfaces. To limit the binding to a single specific interface, you can specify the IP address in the Bind to address field. Otherwise, leave this field blank. (If the Bind to address field is left blank, it will listen on all interfaces. This is the best option in most cases.)
For example, if you have two non-routed interfaces on the computer, 192.168.1.1 and 192.168.2.1, then you can choose to bind to only the 192.168.1.1 interface. This will ignore any syslog messages sent to the other interface.
The Cisco PIX uses port 1468. Its default behavior is that if it cannot connect to the syslog server, it blocks all network traffic through it. For more information on the Cisco Pix Firewall, please refer to Cisco website.
If you are receiving messages from systems that use different data encoding formats, you can specify the decoding method to apply to the incoming data. The default is to use the System code page.
Select a commonly used encoding format from the drop-down menu. Or, to select a different encoding, choose "Other-->" and then enter the code page number into the field on the right.
The various code pages available on most Windows systems can be found on the Microsoft website. Here are some common code page numbers that can be used.
System Code Page
Japanese Extended Unix Code
If the number you specify is not a valid Code Page on your system, the incoming data will not be decoded correctly and will be dropped. If in doubt, use UTF-8 encoding (65001) as it will handle all Unicode characters.
Because Syslog messages that are sent via TCP are not necessarily contained in a single TCP packet, Kiwi Syslog Server has a buffering facility which accumulates sequential TCP packets in an internally. Because of this, Kiwi Syslog Server needs to know how to identify separate Syslog messages in a single TCP stream. It does this through the use of message delimiters (or separators). Each delimiter signifying the character (or sequence of characters) that will be used to split the stream into individual Syslog messages.
The kind of delimiter to use depends very much on the client or device which is sending Syslog over TCP.
- Click Apply to save your changes.