b4lk1

[Guest Gabriele]

Hello,

i'm using Passwordstate 8.5 (build 8573). I set under system settings-> proxy & syslog servers my syslog server and saved (also restarted the VM). 

 

The problem is that passwordstate is not sending data to my syslog server. I've already tried with TCP and UDP.

 

Thanks in advance

[support]

Hello,

 

There should be only a few things which could affect this:

• A firewall is blocking traffic being sent
• Your Passwordstate Windows Service is not started
• Or in the web.config file, located in the root of the Passwordstate folder, the PassiveNode key is not set to false

Can you check these things out?

Regards

Click Studios

[b4lk1]

Hello,

 

-firewall is disabled , i can reach my syslog server with ping or with telnet on tcp 514 port

-passwordstate service is running

-In the file "C:\inetpub\Passwordstate\web.config" i have the PassiveNode key set in this way:

 <appSettings>
    <add key="SetupStage" value="Setup Complete" />
    <add key="PassiveNode" value="False" />

 

is it ok?

Thanks!

[support]

Hello,

 

Yes, all those settings are fine, so I'm not sure why you are seeing this issue. If you look in the Windows Application Event log on your web server, do you see any errors?

 

In the database, we also track which was the last audit record sent to the Syslog server. If you run the following query using SQL Management Studio, what is the value it reports? Is it higher than the last AuditID value within the Auditing table - it should never be higher?

 

USE Passwordstate

SELECT SyslogLastAuditRecord FROM SystemSettings

 

Regards

Click Studios

[b4lk1]

On 1/16/2019 at 12:01 AM, support said:

Hello,

 

Yes, all those settings are fine, so I'm not sure why you are seeing this issue. If you look in the Windows Application Event log on your web server, do you see any errors?

 

In the database, we also track which was the last audit record sent to the Syslog server. If you run the following query using SQL Management Studio, what is the value it reports? Is it higher than the last AuditID value within the Auditing table - it should never be higher?

 

USE Passwordstate

SELECT SyslogLastAuditRecord FROM SystemSettings

 

Regards

Click Studios

Hello, in attachment the result of the query (how can i check the AuditID value against the Auditing table?)

Also i cannot see any error in the event viewer.

Thanks!

[b4lk1]

hello,

 

any news?

 

thanks

[support]

Sorry, we're not sure why this is happening for you.

 

Can you monitor traffic on your Passwordstate web server to see if it's attempting to send auditing data - you could use something like Wireshark for this?

 

Also, maybe double check the Syslog server details you've specific on the System Settings screen - make sure the Host Name and Port are correct.

Regards

Click Studios

[b4lk1]

hello,

 

i used wireshark & tcpdump on syslog side and saw that passwordstate is correctly sending the data. I'll check on syslog server side. Thanks!

[b4lk1]

Turned out to be a Graylog parse error. Solution was to use raw udp and use custom extractors.

Thanks and have a good day

[support]

Thanks for letting us know