Guest Gabriele Posted January 15, 2019 Report Share Posted January 15, 2019 Hello, i'm using Passwordstate 8.5 (build 8573). I set under system settings-> proxy & syslog servers my syslog server and saved (also restarted the VM). The problem is that passwordstate is not sending data to my syslog server. I've already tried with TCP and UDP. Thanks in advance Link to comment Share on other sites More sharing options...
support Posted January 15, 2019 Report Share Posted January 15, 2019 Hello, There should be only a few things which could affect this: A firewall is blocking traffic being sent Your Passwordstate Windows Service is not started Or in the web.config file, located in the root of the Passwordstate folder, the PassiveNode key is not set to false Can you check these things out? Regards Click Studios Link to comment Share on other sites More sharing options...
b4lk1 Posted January 15, 2019 Report Share Posted January 15, 2019 Hello, -firewall is disabled , i can reach my syslog server with ping or with telnet on tcp 514 port -passwordstate service is running -In the file "C:\inetpub\Passwordstate\web.config" i have the PassiveNode key set in this way: <appSettings> <add key="SetupStage" value="Setup Complete" /> <add key="PassiveNode" value="False" /> is it ok? Thanks! Link to comment Share on other sites More sharing options...
support Posted January 15, 2019 Report Share Posted January 15, 2019 Hello, Yes, all those settings are fine, so I'm not sure why you are seeing this issue. If you look in the Windows Application Event log on your web server, do you see any errors? In the database, we also track which was the last audit record sent to the Syslog server. If you run the following query using SQL Management Studio, what is the value it reports? Is it higher than the last AuditID value within the Auditing table - it should never be higher? USE Passwordstate SELECT SyslogLastAuditRecord FROM SystemSettings Regards Click Studios Link to comment Share on other sites More sharing options...
b4lk1 Posted January 17, 2019 Report Share Posted January 17, 2019 On 1/16/2019 at 12:01 AM, support said: Hello, Yes, all those settings are fine, so I'm not sure why you are seeing this issue. If you look in the Windows Application Event log on your web server, do you see any errors? In the database, we also track which was the last audit record sent to the Syslog server. If you run the following query using SQL Management Studio, what is the value it reports? Is it higher than the last AuditID value within the Auditing table - it should never be higher? USE Passwordstate SELECT SyslogLastAuditRecord FROM SystemSettings Regards Click Studios Hello, in attachment the result of the query (how can i check the AuditID value against the Auditing table?) Also i cannot see any error in the event viewer. Thanks! Link to comment Share on other sites More sharing options...
b4lk1 Posted January 21, 2019 Report Share Posted January 21, 2019 hello, any news? thanks Link to comment Share on other sites More sharing options...
support Posted January 21, 2019 Report Share Posted January 21, 2019 Sorry, we're not sure why this is happening for you. Can you monitor traffic on your Passwordstate web server to see if it's attempting to send auditing data - you could use something like Wireshark for this? Also, maybe double check the Syslog server details you've specific on the System Settings screen - make sure the Host Name and Port are correct. Regards Click Studios Link to comment Share on other sites More sharing options...
b4lk1 Posted January 23, 2019 Report Share Posted January 23, 2019 hello, i used wireshark & tcpdump on syslog side and saw that passwordstate is correctly sending the data. I'll check on syslog server side. Thanks! Link to comment Share on other sites More sharing options...
b4lk1 Posted January 23, 2019 Report Share Posted January 23, 2019 Turned out to be a Graylog parse error. Solution was to use raw udp and use custom extractors. Thanks and have a good day Link to comment Share on other sites More sharing options...
support Posted January 23, 2019 Report Share Posted January 23, 2019 Thanks for letting us know Link to comment Share on other sites More sharing options...
Recommended Posts
Archived
This topic is now archived and is closed to further replies.