Syslog for Windows

Several free and commercial implementation of Windows syslog daemon exist. Windows Services for Unix (SFU 3.5 ) contains syslogd daemon that can forward messages to Unix LOGHOST.

So in a way syslogd is a standard Windows component, a part of Microsoft "Linux for Windows".  Version that ships with SFU3.6 is old and an update is available from UNIX Tools Community (free registration required):

Syslogd Version 1.1.2 for SFU 3.5
binary: /pkgs/3.5/syslogd-current-bin.tgz
src: update to SFU version
Updated: 2005-09-06

Like any standard syslog daemon it is capable of both writing messages to files and sending mail to Windows users, depending of their origin and severity.  Also provided is a standard logger utility which is slightly deferent from Solaris (accepts no options).  It also has an updated version UNIX Tools Community:

logger Version 1.0 for SFU 3.5
binary: /pkgs/3.5/logger-current-bin.tgz
src: update to SFU version
Added: 2005-01-05

Here is the default /etc/syslog.conf file for the Interix log daemon. It does not forward messages to users, only write them to files:

# /etc/syslog.conf
#
# RCSid = $Id: syslog.conf,v 1.8 1999/07/21 18:08:25 mark Exp $
#
#
# -- We try to keep all files in /var/adm/log regardless of their basename.
# -- This should keep it simpler for log scans and rotations, but you
# -- can change this if you already have site preferences.
#
# -- Each file must EXIST when syslogd is started if you
# -- want information to be logged to that file;
# -- syslogd will NOT create files.
#
# -- For more information see the man page "syslog.conf".
#
# -- NOTE: on Interix, the /dev/console device file is available but
# -- you need to run a program that attaches a physical device
# -- to this device file. A program like 'xconsole'.
#

*.err;kern.*;auth.notice;authpriv.none;mail.crit /dev/console
*.notice;*.info;authpriv,ftp.none;kern.debug;mail.crit /var/adm/log/messages
mail.* /var/adm/log/mail
ftp.* /var/adm/log/ftp

# -- NOTE: the following files (messages, lpr, mail, ..)
# -- have already been created during the installation of Interix.
# -- Uncomment out the following entries to which you want syslogd
# -- to write information.

# lpr.info /var/adm/log/lpr
# uucp.info /var/adm/log/uucp
# news.* /var/adm/log/news
# daemon.* /var/adm/log/daemon

# -- The authpriv log file should be restricted access; these
# -- messages shouldn't go to terminals or publically-readable
# -- files.
#
# authpriv.* /var/adm/log/secure

#
# The following are commented out for the Administrator to turn on
# if desired. As mentioned on the man page, user names are to be prefixed
# with the name of the domain. Since we don't know yours (and it won't
# always be that domainname equals machinename) "<DOMAIN>" should be
# replaced with the domainname of your choice.
#
# *.emerg *
# *.alert <DOMAIN>+Administrator
# *.err,authpriv.none <DOMAIN>+Administrator
# *.notice;auth.debug <DOMAIN>+Administrator

As you can see the default location of the messages file is /var/adm/log, not /var/adm like in Solaris.  Interix daemon uses standard Unix syslog messages classification without any changes.

NEWS CONTENTS

• 20060207 : SFU 3.5 ( softpanorama.org, Feb 7, 2006 )
• 20051212 : http://syslog-win32.sourceforge.net ( http://syslog-win32.sourceforge.net, Dec 12, 2005 )

Old News ;-)

[Feb 7, 2006] Windows Services for Unix (SFU 3.5 ) contains syslogd daemon that can forward messages to LOGHOST.

So in a way syslogd is a standard Windows component, part of Microsoft "Linux for Windows".

[Dec 12, 2005] http://syslog-win32.sourceforge.net

A very interesting implementation of syslogd daemon for windows by Alexander Yaworsky. Quality coding.

Recommended Links

Internal

• Softpanorama Microsoft Services For Unix page
• Syslog Configuration and /etc/syslog.conf
• Log analyzers

External

• http://syslog-win32.sourceforge.net A very interesting open source implementation of syslog daemon for windows by Alexander Yaworsky. Quality coding. This is another syslog for windows, it includes daemon and client. Features:
  • RFC 3164-compliant;
  • high performance;
  • message forwarding;
  • log rotation;
  • completely open-source.

• NTsyslog Windows NT/2000/XP syslog service. License: GPL. Copyright © 1998-2002, SaberNet.net All rights reserved.

This program runs as a service under Windows NT based operating systems. It formats all System, Security, and Application events into a single line and sends them to a syslog(3) host.

Example:

Oct 18 21:37:34 test1.sabernet.net security[success] Successful Logon:  User
Name:Administrator  Domain:TEST1  Logon ID:(0x0,0x36D166)  Logon Type:7  Logon Process
:User32    Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0  Work
station Name:TEST1 

The package is available for download at:

http://sourceforge.net/projects/ntsyslog/

• Kiwi Syslog Daemon is a freeware syslog Daemon for the Windows platform.Win95,98,NT, 2000] It receives, logs, displays and forwards syslog messages from hosts such as routers, switches, Unix hosts and any other syslog enabled device. There are many customisable options available. Features include: PIX firewall, LinkSys home firewall, SNMP Trap and TCP support. A Service Edition is available for use on NT/2K/XP. The registered version has additional features. [ http://www.kiwi-enterprises.com/"Basic" features are free, more advanced features require $49 registration.

http://www.mt.lv/3index.html#utilsMicrotik syslog daemon [Win95,98,NT,2000] Freeware. This is a networking hardware manufacturer from Latvia. A nice and compact standard syslog daemon.

Gsyslog GSyslog is a graphic (transparent) syslog client for windows 2000 (w2k) and windows xp (wxp). It supports syslog relaying.

Random Findings

InterSect Alliance - Information Technology Security - Open Source

Snare for Windows is a Windows NT, Windows 2000, Windows XP, and Windows 2003 compatible service that interacts with the underlying Windows Eventlog subsystem to facilitate remote, real-time transfer of event log information.

Event logs from the Security, Application and System logs, as well as the new DNS, File Replication Service, and Active Directory logs are supported. Log data is converted to text format, and delivered to a remote Snare Server, or to a remote Syslog server with configurable and dynamic facility and priority settings.

Snare is currently used by hundreds of thousands of individuals, and organisations worldwide. Snare for Windows is used by many large Financial, Insurance, Healthcare, Defence, AeroSpace, and Intelligence organisations to meet elements of local and federal security requirements, such as:

• ACSI 33
• GLBA (Gramm-Leach-Bliley Act)
• Sarbanes Oxley (SOX)
• C2 / CAPP
• DCID 6/3
• DIAM 50-4
• DDS-2600-5502-87 Chapter 4
• NISPOM Chapter 8
• HIPAA
• California Senate Bill 1386
• USA Patriot Act

Syslog.org Syslog Help + General Sys Admin

• 3COM Windows syslog daemon This is a FREE windows syslog daemon from 3com. Does not terminate lines properly. Early versions are useless.
  
• NTsyslog
  
• MonitorWare Agent MonitorWare Agent is a multi-source to syslog forwarder. Among others, it forwards information form the Windows Event Log, text files, databases, serial devices, .... to a syslog server. It can also act as a syslog relay and server itself.
  
• LogLady
  LogLady is a fast Syslog server for Windows. LogLady allows you to collect all the Syslog traffic on your network in a single place. Many devices on your network can probably output Syslog messages. Printers, routers, firewalls, Linux computers, and Windows can all output syslog messages. LogLady provides a way to filter, analyze, and act on messages. You may want to be e-mailed when a router identifies an issue. Some messages could trigger the execution of a program to deal with the situation. LogLady can do all this and more. We hope you like
  
• EventCollector
  Centrally monitor eventlogs, no agents needed; Send alerts to different people on different events; Integrated with ticket tracking system; Forward events to syslogd; Archive events into MYSQL/MSSQL; Web interface to search for events; EventCollector collects events from Windows eventlogs across the network, keeps them in an SQL database, and sends out email alerts when specific events happen.

winlogd - Windows syslog client that sends Event Log to syslog - Edoceo, Inc.

Winlogd is a syslog client for Windows that allows the Event Log to talk to syslog. It runs as a Service monitoring the Windows Event Log and forwarding the messages to a syslog server. This allows an administrator to integrate Windows into their current syslog scheme and effectively monitor the Windows machines via simple syslog scripts.

Oh the beauty of syslog servers, all my logs in one central location, easy to analyse and manage. Thousands of network devices (firewalls, routers, switches, storage, etc...) from major manufacturers (Cisco, 3Com, HP, etc...) can send messages to syslog. Whats this!? Windows doesn't understand how to talk to syslog!?. With winlogd now it can; winlogd will monitor the Windows Event Log and send messages to the specified syslog server when they arrive. Parameters - including server, port and facility - are configurable via the Windows Registry.

www.practicallynetworked.com/Logging via Syslog

Windows Syslog Daemons

1. SYSLOGD
A very simple freeware program. We are running it on Win95. It records the received syslog message in a file called "SYSLOG' but has a big draw back. If you lose power to the logging PC, you must delete the "SYSLOG" file before the program will start logging again. Also, the program keeps the file open so you can not access the data with another program while it is running. This program along with a timer program can work very nicely. The timer program stops the syslog and renames the log file and then restarts the syslog program. This is the combination that I am using until #2 has an ASCII format. For Additional Info see: Winsite

2. SDS15000
From Triaction and is on its way to being a great shareware program. A new release (1.50.00) is available. This release has an option for an ASCII file format. We are testing this product on Win95. The version available here has a thirty day time lock.

3. Syslog Client DLL 1.1
A freeware DLL. We have not tried this program

4. A14NT03
A freeware NT program. We have not tried this program. It is by the same creator as #3.

5. PIXCNF04
Found on the web site of a company(PIX) bought by Cisco(I think). The file includes two programs(and their help files). One of the programs is a very good syslog recorder and file creator. It does not have the same problem as #1 but it has a different one. If you are logging data from an Ascend box, this program will loose the last character of the line. I do not know if this is freeware/shareware/Cisco only. The file did not have anything in it one way or the other. I have run this on Win95.

Weird Solutions - Headlines

Syslog Turbo for Microsoft Windows

Syslog is the defacto logging facility for Unix, Linux and many popular embedded hardware devices.

"After we took a close look at how our customers used Syslog, we quickly realized that for enterprises, a very fast centralized database design was the way to go. In fact a lot of work went into enhancing the core database. We wanted to offer our users a very powerful and scalable auditing platform.", says senior software development engineer Johan Bosaeus.

Key features:

• Database backend: over 20,000 log-entries/sec
• Custom expressions for analyzing and filtering messages
• Log archiving for space optimization
• SQL-style remote queries using secure connections
• Available for Windows, Linux and Solaris platforms

Availability & Pricing:

• Pricing: starting at $195.00
• Availability: December 2003
  

Windows Syslog

Do your systems like Cisco routers talk syslog protocol? Would you like to receive these messages on your Windows PC? No problem! WinSyslog will do exactly that. [more...]

WinSyslog is part of Adiscon's MonitorWare line of products. If you look for a complete monitoring solution, consider teaming up with the other components.

Etc

Society

Groupthink : Two Party System as Polyarchy : Corruption of Regulators : Bureaucracies : Understanding Micromanagers and Control Freaks : Toxic Managers :   Harvard Mafia : Diplomatic Communication : Surviving a Bad Performance Review : Insufficient Retirement Funds as Immanent Problem of Neoliberal Regime : PseudoScience : Who Rules America : Neoliberalism  : The Iron Law of Oligarchy : Libertarian Philosophy

Quotes

War and Peace : Skeptical Finance : John Kenneth Galbraith :Talleyrand : Oscar Wilde : Otto Von Bismarck : Keynes : George Carlin : Skeptics : Propaganda  : SE quotes : Language Design and Programming Quotes : Random IT-related quotes :  Somerset Maugham : Marcus Aurelius : Kurt Vonnegut : Eric Hoffer : Winston Churchill : Napoleon Bonaparte : Ambrose Bierce :  Bernard Shaw : Mark Twain Quotes

Bulletin:

Vol 25, No.12 (December, 2013) Rational Fools vs. Efficient Crooks The efficient markets hypothesis : Political Skeptic Bulletin, 2013 : Unemployment Bulletin, 2010 :  Vol 23, No.10 (October, 2011) An observation about corporate security departments : Slightly Skeptical Euromaydan Chronicles, June 2014 : Greenspan legacy bulletin, 2008 : Vol 25, No.10 (October, 2013) Cryptolocker Trojan (Win32/Crilock.A) : Vol 25, No.08 (August, 2013) Cloud providers as intelligence collection hubs : Financial Humor Bulletin, 2010 : Inequality Bulletin, 2009 : Financial Humor Bulletin, 2008 : Copyleft Problems Bulletin, 2004 : Financial Humor Bulletin, 2011 : Energy Bulletin, 2010 : Malware Protection Bulletin, 2010 : Vol 26, No.1 (January, 2013) Object-Oriented Cult : Political Skeptic Bulletin, 2011 : Vol 23, No.11 (November, 2011) Softpanorama classification of sysadmin horror stories : Vol 25, No.05 (May, 2013) Corporate bullshit as a communication method  : Vol 25, No.06 (June, 2013) A Note on the Relationship of Brooks Law and Conway Law

History:

Fifty glorious years (1950-2000): the triumph of the US computer engineering : Donald Knuth : TAoCP and its Influence of Computer Science : Richard Stallman : Linus Torvalds  : Larry Wall  : John K. Ousterhout : CTSS : Multix OS Unix History : Unix shell history : VI editor : History of pipes concept : Solaris : MS DOS :  Programming Languages History : PL/1 : Simula 67 : C : History of GCC development :  Scripting Languages : Perl history   : OS History : Mail : DNS : SSH : CPU Instruction Sets : SPARC systems 1987-2006 : Norton Commander : Norton Utilities : Norton Ghost : Frontpage history : Malware Defense History : GNU Screen : OSS early history

Classic books:

The Peter Principle : Parkinson Law : 1984 : The Mythical Man-Month :  How to Solve It by George Polya : The Art of Computer Programming : The Elements of Programming Style : The Unix Hater’s Handbook : The Jargon file : The True Believer : Programming Pearls : The Good Soldier Svejk : The Power Elite

Most popular humor pages:

Manifest of the Softpanorama IT Slacker Society : Ten Commandments of the IT Slackers Society : Computer Humor Collection : BSD Logo Story : The Cuckoo's Egg : IT Slang : C++ Humor : ARE YOU A BBS ADDICT? : The Perl Purity Test : Object oriented programmers of all nations : Financial Humor : Financial Humor Bulletin, 2008 : Financial Humor Bulletin, 2010 : The Most Comprehensive Collection of Editor-related Humor : Programming Language Humor : Goldman Sachs related humor : Greenspan humor : C Humor : Scripting Humor : Real Programmers Humor : Web Humor : GPL-related Humor : OFM Humor : Politically Incorrect Humor : IDS Humor : "Linux Sucks" Humor : Russian Musical Humor : Best Russian Programmer Humor : Microsoft plans to buy Catholic Church : Richard Stallman Related Humor : Admin Humor : Perl-related Humor : Linus Torvalds Related humor : PseudoScience Related Humor : Networking Humor : Shell Humor : Financial Humor Bulletin, 2011 : Financial Humor Bulletin, 2012 : Financial Humor Bulletin, 2013 : Java Humor : Software Engineering Humor : Sun Solaris Related Humor : Education Humor : IBM Humor : Assembler-related Humor : VIM Humor : Computer Viruses Humor : Bright tomorrow is rescheduled to a day after tomorrow : Classic Computer Humor

The Last but not Least Technology is dominated by two types of people: those who understand what they do not manage and those who manage what they do not understand ~Archibald Putt. Ph.D

The statements, views and opinions presented on this web page are those of the author (or referenced source) and are not endorsed by, nor do they necessarily reflect, the opinions of the Softpanorama society. We do not warrant the correctness of the information provided or its fitness for any purpose. The site uses AdSense so you need to be aware of Google privacy policy. You you do not want to be tracked by Google please disable Javascript for this site. This site is perfectly usable without Javascript.

Last modified: March 12, 2019