Playbook
Home / Logging & Syslog / Install

Install a syslog server on Windows

careful beginner #windows#kiwi#visual syslog#install#firewall

When to use this: You want to receive syslog on a Windows machine, for example because there is no Linux host.

Be careful with this one. Open the Windows firewall only for your senders' IPs.

Before you start

Steps

  1. Pick an application

    Common choices: Visual Syslog Server (free, simple viewer), Kiwi Syslog Server from SolarWinds (commercial, runs as a service, alerts and actions), or a log platform such as Graylog on a Linux VM. Download only from the vendor's official site and check the current licence and price.

  2. Install it and set it to run as a service

    Prefer the service/daemon option so it starts at boot without a user logged in. Run it as a normal service account, not as your own admin user.

  3. Allow the port in Windows Defender Firewall

    PowerShellGit Bash
    New-NetFirewallRule -DisplayName "Syslog UDP 514" -Direction Inbound -Protocol UDP -LocalPort 514 -RemoteAddress 192.168.1.1 -Action Allow
New-NetFirewallRule -DisplayName "Syslog TCP 514" -Direction Inbound -Protocol TCP -LocalPort 514 -RemoteAddress 192.168.1.1 -Action Allow# Run this in PowerShell, not Git Bash.
powershell.exe -Command "New-NetFirewallRule -DisplayName 'Syslog UDP 514' -Direction Inbound -Protocol UDP -LocalPort 514 -RemoteAddress 192.168.1.1 -Action Allow"

    Replace 192.168.1.1 with your firewall's IP. -RemoteAddress restricts who may send.

  4. Confirm it is listening

    terminal
    netstat -ano | findstr :514

    You should see a line for UDP 0.0.0.0:514 owned by the syslog application's process ID.

  5. Choose where logs are stored

    Point the application's log folder at a disk with enough space, and configure its retention or archive rule (most tools have a 'delete after N days' option).

  6. Point your device at this PC and watch the messages arrive

    Set the device's syslog server to this PC's IP and port 514. New messages should appear in the application's live view.

How to verify it worked

  • netstat shows port 514 listening, and the application's live view shows a test message from your device.

How to undo it

Remove the firewall rules:

PowerShellGit Bash
Remove-NetFirewallRule -DisplayName "Syslog UDP 514"
Remove-NetFirewallRule -DisplayName "Syslog TCP 514"powershell.exe -Command "Remove-NetFirewallRule -DisplayName 'Syslog UDP 514'; Remove-NetFirewallRule -DisplayName 'Syslog TCP 514'"

Common errors and fixes

Nothing arrives, but netstat shows 514 listening The firewall rule is missing or the wrong profile (Public vs Private). Check the rule, and check the device's source IP matches -RemoteAddress.
New-NetFirewallRule says access denied Open PowerShell as Administrator.
Logs stop after Windows Update or a reboot The application is not running as a service. Configure the service to start automatically.
Running it in WSL2 and nothing arrives WSL2 usually sits behind a NAT that the LAN cannot reach. Use a real VM with a bridged adapter, or WSL's mirrored networking mode if available on your Windows version.

Q&A

Can Windows itself send its event log by syslog?

Not natively. You need an agent such as NXLog, or you collect with Windows Event Forwarding. See the Windows events scenario.

Is a Windows syslog server a good production choice?

It can work for small setups if the host is always on and patched. For scale, search and low cost, a Linux VM is usually better.

Practice these as flashcards →

Terms in this scenario

Syslog server

Related scenarios

My notes

Saved in this browser only.