Welcome to SL4NT 3.2

Let us know if there's anything missing that you'd like to see implemented in a future release of this product. Send e-mail to featurerequest@netal.com.

If you should detect a bug, please send e-mail to bugreport@netal.com.

The Release Notes contain additional information on how to obtain support and how to provide feedback using newsgroups.

netal.gif (2049 bytes)
http://www.netal.com

Franz Krainer
franzk@netal.com


SL4NT 3.2 Release Notes

Welcome to SL4NT 3.2. Please refer to these release notes to obtain the most up-to-date information about installation, documentation, support, and other known issues.

What's New
Upgrading from SL4NT 1.x, 2.x or 3.x
Installing SL4NT 3.2
Product Documentation
Evaluation License and License Types
Known Problems and Limitations
Providing Feedback
Technical Support

What's New

Fixes:

The following problems have been fixed in SL4NT 3.2:

  • If <Derived> is specified as Facility value in a Forward Syslog Message Action, forwarded syslog messages are sent with incorrect facility and priority codes.
  • If the configured time zone does not use daylight saving time (e.g. Tokyo Standard Time), SMTP messages sent by a Send E-Mail Message Action contain an incorrect message date.

New features:

  • Support for automatic creation of new log files every hour.
  • Support was added for receiving syslog messages over TCP, when the message text is terminated by a NUL character.

Upgrading from SL4NT 1.x, 2.x or 3.x

The setup program will detect if SL4NT 1.x, 2.x or 3.x is installed on the computer, in which case you are asked if you want to upgrade to SL4NT 3.2. If you agree and v1.x is installed, the current configuration is saved, all installed components of SL4NT 1.x are removed, SL4NT 3.2 is installed and the previous configuration is restored. If you agree and v2.x or v3.x is installed, the installed product components are replaced by the new ones.

Installing SL4NT 3.2

Prerequisites for installation on Windows NT 4.0:

  • All components:
    • Service Pack 3 (or later)
  • Syslog Service:
    • TCP/IP
  • SL4NT Manager:
    • Microsoft Management Console (MMC) 1.1 or later. If not already installed, you can download MMC 1.2 here

Prerequisites for installation on Windows 2000/XP/2003:

  • Syslog Service:
    • TCP/IP

See SL4NT System Requirements for more information.

Other installation considerations

Before you install SL4NT

  • You must be logged in as an administrator of the system where you want to install the application.
  • Make sure that no application is currently monitoring any performance counter of the computer. Registration of SL4NT performance counters may fail if the performance monitoring subsystem is in use.
  • If our Freeware product SL4NT 0.3 is currently installed on the system, you must remove it before you can install SL4NT 3.2. The setup program does not support updating v0.3 to v3.2.

See Installing SL4NT for more information.

Uninstalling the product

Before you uninstall SL4NT

  • You must be logged in as an administrator of the system to uninstall the application.
  • Make sure that no application is currently monitoring any performance counter of the computer. Deregistration of SL4NT performance counters may fail if the performance monitoring subsystem is in use.

To uninstall the product, open the Add/Remove Programs applet in the Control Panel, select SL4NT 3.2 and click the Add/Remove button.

See Uninstalling SL4NT for more information.

Product Documentation

The documentation for the product is available by accessing the Product Documentation item in the program group if created or it can be accessed from within the SL4NT Manager.

Evaluation License and License Types

After installation (except upgrading from a licensed version of SL4NT you are using an evaluation license which will expire after 60 days. According to the End-User License Agreement ("EULA"), on expiration of the evaluation license, you must either purchase one or more valid product licenses to convert the evaluation software into the commercial version or alternatively completely uninstall the SL4NT software. To order licenses or to find detailed ordering information, please go to http://www.netal.com/sl4nt.htm.

Known Problems and Limitations

As soon as bugs are reported, information about them will be published at http://www.netal.com/sl4nt.htm.

Providing Feedback

Peer-to-peer newsgroups are available to help you interact with other SL4NT users. You can use any newsreader software to access these newsgroups. Regardless of the newsreader or news client you are using, you may need to configure it to read the newsgroups. When prompted for the name of the news server, specify news.netal.com. You do not need to enter an account name or password.

There are currently three newsgroups dedicated to the product SL4NT:

General (netal.sl4nt.general)

Setup (netal.sl4nt.setup)

SDK (netal.sl4nt.sdk)

Another way to provide feedback is by sending e-mail to bugreport@netal.com if you detect a bug or by sending e-mail to featurerequest@netal.com if there is anything else that you would like to see implemented in this product in the future.

Technical Support

If you have a technical question about SL4NT, use this online documentation or consult Help by clicking the Help button during a procedure. If you still have a question, post it to one of the newsgroups mentioned above. We monitor SL4NT newsgroups regularly and will try to answer questions as soon as possible. You can also send your technical questions to support@netal.com.

Copyright Information

© 1997-2005 Franz Krainer

These materials are provided "as-is", for informational purposes only.

Neither Franz Krainer nor his suppliers makes any warranty, express or implied with respect to the content of these materials or the accuracy of any information contained herein, including, without limitation, the implied warranties of merchantability or fitness for a particular purpose. Because some states/jurisdictions do not allow exclusions of implied warranties, the above limitation may not apply to you.

Neither Franz Krainer nor his suppliers shall have any liability for any damages whatsoever including consequential, incidental, direct, indirect, special, and lost profits. Because some states/jurisdictions do not allow exclusions of implied warranties, the above limitation may not apply to you.

2005-02-11


Product Information

Welcome to the Product Information topics. This section provides general information about the product SL4NT.

This section contains:

  • Product Features: List of implemented features.
  • Product Components: Describes the two main components of SL4NT.
  • Product History: List of fixes and new features since the release of v1.0.


Product Features

SL4NT 3.2 is an application which implements a syslog daemon. The purpose of a syslog daemon is to listen for incoming syslog messages from the network and then decode and process the messages for logging and notification purposes.

Feature List:

  • Implemented as a multithreaded service
  • Support for asynchronous message processing
  • Receiver engine supports listening on multiple UDP/TCP ports
  • Rule based message processing
  • Support for trigger threshold settings
  • Supported rule conditions:
    • Facility
    • Priority
    • Source IP address
    • Destination IP address and UDP/TCP port
    • Receive time
    • Substring search in message text/Regular Expression matching
    • Custom evaluator object (implemented as an ActiveX object)
  • Supported rule actions:
    • Execute custom handler (implemented as an ActiveX object)
    • Forward message to viewer (Telnet)
    • Forward syslog message to another syslog daemon
    • Log message to an ODBC database
    • Log message to log file
    • Log message to Windows NT Event Log (Application, Security, System)
    • Run program
    • Send e-mail (SMTP) message (MIME 1.0 compliant)
    • Send network alert
  • Completely customizable log format
  • Support for automatic log file purging based on file size
  • Support for automatic creation of new log files periodically (hourly, daily, weekly, monthly) or when a particular file size has been reached
  • Support for IP address to hostname resolution with caching for resolved mappings
  • Performance counter extension
  • An MMC Snap-In for local and remote administration
  • Support for generating syslog messages for testing or troubleshooting purposes
  • Support for saving/restoring service configurations to/from text files
  • Support for configuring the syslog service using configuration files


Product Components

SL4NT consists of two main components:

Syslog Service

This component represents the syslog server/daemon and is implemented as a Windows NT/2000/XP service.

SL4NT Manager

This component represents the UI for administering SL4NT and is implemented as an MMC Snap-In. It allows for local and remote configuration of Syslog Services.


Product History

SL4NT 3.2 -/- 2005-02-11

Fixes:

The following problems have been fixed in SL4NT 3.2:

  • If <Derived> is specified as Facility value in a Forward Syslog Message Action, forwarded syslog messages are sent with incorrect facility and priority codes.
  • If the configured time zone does not use daylight saving time (e.g. Tokyo Standard Time), SMTP messages sent by a Send E-Mail Message Action contain an incorrect message date.

New features:

  • Support for automatic creation of new log files every hour.
  • Support was added for receiving syslog messages over TCP, when the message text is terminated by a NUL character.

SL4NT 3.1 -/- 2003-01-29

Fixes:

The following problems have been fixed in SL4NT 3.1:

  • The service in unable to write message data to log files that are larger than 4 GB.
  • The service may fail to write message data to an Oracle database, depending on the specific combination of Oracle DBMS version and ODBC driver version.
  • When you use Performance Monitor to monitor the performance counters of the SL4NT performance object (Syslog Service) through a Terminal Server session, every counter shows zero for statistics.

New features:

SL4NT 3.1 does not contain any new features.

SL4NT 3.0 -/- 2002-05-17

Fixes:

The following problems have been fixed in SL4NT 3.0:

  • After service stop has been initiated, the service will only stop if at least one second passes between two consecutive received syslog messages. This means that if the syslog service is permanently receiving messages, the service stop operation will timeout and fail.
  • The syslog service does not automatically perform a reconnect to an ODBC database in case that the current connection fails due to network errors or database service errors.

New features:

SL4NT 3.0 contains the following new features:

  • Message receiver engine:
    • Support for listening on multiple UDP ports
    • Support for listening on TCP ports has been added
    • Improved performance and lower resource usage
  • Rule processing engine:
    • The Destination condition has been enhanced to include the UDP/TCP port in addition to the IP address
    • Support for custom evaluator objects
    • Support for custom action objects
    • Support for 16 custom data fields per message
    • Support for custom mapping of SL4NT data field names to ODBC table column names
  • Viewer server:
    • New command (LCH) to list all configured channels
    • Data from more than one channel can be viewed in the same session at the same time
    • Access control settings to grant or deny access to specified clients

SL4NT 2.1 -/- 2000-04-28

Fixes:

No bugs regarding the SL4NT application itself have been reported since the release of SL4NT 2.0.

New features:

SL4NT 2.1 contains the following new features:

  • Trigger threshold settings can be configured for a rule. This allows you to specify that the referenced actions should not be executed for each matching syslog message but only if more than a configurable number of matching syslog messages is received within a configurable time window.
  • The properties of the syslog service can alternatively be configured using files.
  • Send syslog messages for testing or troubleshooting purposes by using the SL4NT Manager Snap-In.
  • The hostname cache can be purged by using the SL4NT Manager Snap-In.
  • Performance improvements

SL4NT 2.0 -/- 2000-02-11

Fixes:

No bugs regarding the SL4NT application itself have been reported since the release of SL4NT 1.4.

New features:

SL4NT 2.0 contains the following new features:

  • The Control Panel applet for configuring the syslog service has been replaced by an MMC Snap-In which supports remote administration.
  • Support for saving/restoring service configurations to/from text files
  • New documentation as HTML Help file
  • Full support for Windows 2000
  • New rule condition: Destination IP Address
  • Fully customizable format of Date and Time log fields
  • Support for fixed-width log field output
  • New functionality of Log to file actions:
    • Remote log file directories can now be specified by providing an UNC path
  • New functionality of Log to ODBC Database actions:
    • Support for alternative short column names
    • Support for SQL_LONGVARCHAR data type
  • The evaluation version is no longer limited to two actions but will expire after 60 days.

SL4NT 1.4 -/- 1999-10-01

Fixes:

No bugs regarding the SL4NT application itself have been reported since the release of SL4NT 1.3.

But there was a problem with the ClSlTest tool, contained in the Support directory of the extracted distribution package. Due to an incompatibility between the provided ClSlTest.exe and ClSyslog.dll, the ClSlTest program crashes immediately before program termination but after sending the syslog message.

New features:

SL4NT 1.4 contains the following new features:

  • Support for viewing received syslog messages in real-time. SL4NT 1.4 now includes a viewer service, which forwards received syslog messages to all connected viewer clients. You can use any Telnet-like application as a viewer. If you intend to use this new feature, please read the corresponding help topic.
  • Support for the usually unused facility codes 10 - 15.

SL4NT 1.3 -/- 1999-07-09

Fixes:

The following problems have been fixed in SL4NT 1.3:

  • Recipient names are prefixed with the string 'From: ' in the To: field of a generated SMTP message header. For example, instead of the correct header line 'To: "Franz Krainer" franzk@netal.com', the line 'To: From: "Franz Krainer" franzk@netal.com' is sent.
  • A domain name starting with a digit, for example: mail.3timesaday.com, is regarded as an invalid one.

New features:

SL4NT 1.3 contains the following new features:

  • Support for Regular Expression matching has been added.

SL4NT 1.2 -/- 1999-04-18

Fixes:

The following problems have been fixed in SL4NT 1.2:

  • The SMTP sender component has an interoperability problem with SMTP servers which are not strictly RFC-compliant.
  • Writing to the Security Event Log fails on NT 4.0 with Service Pack 4 or later installed.
  • ODBC-logging does not support columns of data type WCHAR or WVARCHAR (Unicode).

New features:

SL4NT 1.2 contains the following new features:

  • The UDP port on which the service is listening for incoming syslog messages can be changed by using the Control Panel Applet (see Other Settings Property Page ).
  • The UDP port to which syslog messages are forwarded can now be configured per action definition (see Forward Syslog Message Action Definition Dialog).
  • A new message information element, the IP address of the interface on which the syslog message has been received, is available for all action types.

SL4NT 1.1 -/- 1997-10-08

Fixes:

The following problems have been fixed in SL4NT 1.1:

  • Setting the value of the rule condition property Max Priority in the Control Panel applet has no effect because the corresponding Registry value is not written when saving the configuration. Because the Registry value is missing when the Control Panel applet or the service reads the current configuration from the Registry, the value of the rule condition property Max Priority is always set to its default value: Emergency
  • Receiving a syslog message larger than the maximum supported size (=1024 bytes) results in incorrect processing of all subsequent syslog messages.

New features:

SL4NT 1.1 contains the following new features:

  • New rule condition: Receive Time
  • Two new action types:
    • Forward Syslog Message
    • Log to ODBC Database
  • Enhancements to the Log to File action:
    In addition to automatically purging a log file, whereby the previous content is lost, it’s now possible to specify that a new log file be created periodically (daily, weekly, monthly) or when a particular file size has been reached.

SL4NT 1.0 -/- 1997-09-03

Initial release.


SL4NT Setup

Welcome to the topics covering SL4NT installation. This section provides general information about installation requirements, procedures, and options. If you are having difficulty with your installation, review this information to be sure your computer is configured correctly and meets all the system requirements.

This section contains:

  • SL4NT System Requirements: Required and recommended software.
  • Installing SL4NT: The installation process on your computer.
  • Unattended SL4NT Installation: Installing automatically by using a response file.
  • Uninstalling SL4NT: How to remove SL4NT from the system.


SL4NT System Requirements

Please be sure that the following software is installed on the computer prior to the installation of SL4NT:

  • Windows NT 4.0, Windows 2000, Windows XP or Windows 2003
  • If using Windows NT 4.0, Service Pack 3 or later must be installed.

SL4NT requires the following software to be installed on the computer prior to using SL4NT:

Windows NT 4.0:

  • All components:
    • Service Pack 3 (or later)
  • Syslog Service:
    • TCP/IP
  • SL4NT Manager:
    • Microsoft Management Console (MMC) 1.x. If not already installed, you can download MMC 1.2 here

Windows 2000/XP/2003:

  • Syslog Service:
    • TCP/IP


Installing SL4NT

Before you can install SL4NT you have to extract all the files contained in the distribution package to a directory of your choice.

Before you install SL4NT

  • You must be logged in as an administrator of the system where you want to install the application.
  • Make sure that no application is currently monitoring any performance counter of the computer. Registration of SL4NT performance counters may fail if the performance monitoring subsystem is in use.
  • If our Freeware product SL4NT 0.3 is currently installed on the system, you must remove it before you can install SL4NT 3.2. The setup program does not support updating v0.3 to v3.2

To install SL4NT

  1. Start the program Setup.exe.
  2. On the Welcome page of the Setup Wizard, click Next.
  3. Read the license agreement on the Software License Agreement page and click Yes only if you accept all the terms of the license agreement.
  4. Read the information shown on the Information page and click Next.
  5. On the Select Components page, select the components to install and the installation location and click Next.
  6. On the Choose Folder Creation page, specify if you want a program folder to be created.
  7. On the Start Copying Files page, review the shown installation settings and click Next if you are satisfied with them.
  8. On the Setup Complete page, which is displayed after successful installation, click Finish.


Unattended SL4NT Installation

The setup program provided supports unattended (silent) installation of SL4NT. In silent mode, the setup program displays no user interface and and requires no user input, taking all necessary settings from a response file. The response file must be created prior to unattended installation by recording a normal installation.

To create the response file for unattended installation

  1. Start the program Setup.exe with the command line parameter -r (Setup.exe -r).
  2. Setup.exe will record all your installation choices in Setup.iss and save the file to the Windows folder.
  3. Copy the response file Setup.iss from the Windows folder to the directory where Setup.exe is located.

To perform an unattended installation

  1. Start the program Setup.exe with the command line parameter -s (Setup.exe -s).


Uninstalling SL4NT

If you decide to remove SL4NT from a system, follow these steps:

Before you uninstall SL4NT

  • You must be logged in as an administrator of the system to uninstall the application.
  • Make sure that no application is currently monitoring any performance counter of the computer. Deregistration of SL4NT performance counters may fail if the performance monitoring subsystem is in use.

To uninstall SL4NT

  1. From the Start menu, choose Settings and then Control Panel.
  2. In Control Panel, double-click Add/Remove Programs.
  3. Select SL4NT 3.2.
  4. Click the Add/Remove button.


Administrator's Guide

Welcome to the Administrator's Guide topics. This section describes how to administer SL4NT on various levels.

This section contains:

  • The Syslog Protocol: Describes what rules, actions and log formats are and how they are related to each other.
  • Rules, Actions and Log Formats: Describes what rules, actions and log formats are and how they are related to each other.
  • Loading the SL4NT Manager Snap-In: Describes how to install the SL4NT Manager Snap-In into the Microsoft Management Console.
  • Administer Computers: Tells how to administer computers where SL4NT is installed on.
  • Configuring Syslog Service Properties Using Files: Tells how the properties of the syslog service may be configured using files.
  • Send Syslog Messages: Describes how to generate syslog messages with the SL4NT Manager.
  • Troubleshooting SL4NT: Describes common problem scenarios and how to resolve them.


The Syslog Protocol

The syslog protocol was developed in the Unix world and is primarily used by Unix hosts and network devices like routers for sending information across the network to a syslog daemon for further processing.

A syslog message is send by a syslog client to a syslog server (daemon), contained in the payload of a UDP datagram (some vendors support also TCP as transport protocol for syslog messages). Usually clients send messages to UDP port 514 but other ports are also used by some implementations.

The format of a syslog message is just ASCII text having the format:

<n>msgtext

where n is a decimal value which encodes the facility and priority code ( n = Facility << 3 | Priority ) and msgtext is the message text.


Rules, Actions and Log Formats

The operational behavior of the Syslog Service is defined by rules and actions. A rule specifies the conditions against which received syslog messages are evaluated, and references actions, which specify what should be done if a syslog message matches the rule conditions.

Rules are organized in an ordered list, which is visible on the Rules Property Page. When a syslog message is received, it is tested against rules, which have the Active flag set, in the order listed. If a syslog message matches the conditions of a rule, the actions referenced by the rule are executed. If the rule which fired has the Stop flag set, no further rules are evaluated, otherwise rule evaluation continues with the next rule in the list.

Actions specify what and how should be done with syslog messages. An action may be referenced by more than one rule.

Log formats specify the format of the output produced by actions.


Loading the SL4NT Manager Snap-In

After you have installed SL4NT, you should load the SL4NT Manager Snap-In into Microsoft Management Console (MMC). This component provides the UI for administering SL4NT.

To load the SL4NT Manager Snap-In:

  1. In MMC, select Console Root.
  2. In the Console menu, select Add/Remove Snap-in.
  3. On the Standalone property page of the Add/Remove Snap-in dialog box, click the Add button.
  4. In the Add Standalone Snap-in dialog box, select SL4NT, and click OK. Click Finish.
  5. The SL4NT node appears in MMC.


Administer Computers

This section explains how to use the SL4NT Manager Snap-In to administer computers where SL4NT is installed.

This section contains:

  • Connect to Computer: Describes how to connect to a computer.
  • Disconnect from Computer: Describes how to disconnect from a computer.
  • Manage Computer: Describes how to manage a computer.
  • Backup Configuration: Describes how to backup the service configuration.
  • Restore Configuration: Describes how to restore the service configuration.
  • Purge Hostname Cache: Describes how to purge the hostname cache.


Connect to Computer

Before you can manage the SL4NT environment of a computer, may it be the local computer or a remote one, you must first create a representation of the computer within the SL4NT Manager Snap-In by connecting to it.

To connect to computer:

  1. Select the SL4NT item in the scope pane.
  2. Click the Connect to computer button, or, on the Action menu, select Connect, or right-click and select Connect.
  3. In the displayed dialog select This computer to connect to the local computer or select The Following computer and enter the name of the remote computer or click Browse to select a remote computer, and click OK.


Disconnect from Computer

To remove a computer from the list of managed computers you must disconnect from it.

To disconnect from computer:

  1. Select the Computer you want to disconnect.
  2. On the Action menu, select Disconnect, or right-click and select Disconnect.
  3. Confirm that you want to disconnect the selected Computer by selecting Yes in the shown message box.


Manage Computer

In the SL4NT environment, computer means a Syslog Service. Managing a computer includes starting or stopping it and viewing or editing its properties.

To start a computer:

  1. Select the Computer you want to start.
  2. Click the Start service button, or, on the Action menu, select Start, or right-click and select Start.

To stop a computer:

  1. Select the Computer you want to stop.
  2. Click the Stop service button, or, on the Action menu, select Stop, or right-click and select Stop.

To restart a computer:

  1. Select the Computer you want to restart.
  2. Click the Restart service button, or, on the Action menu, select Restart, or right-click and select Restart.

To view or edit properties of a computer:

  1. Select the Computer whose properties you want to view or edit.
  2. Click the Properties button, or, on the Action menu, select Properties, or right-click and select Properties.


Backup Configuration

You can save the syslog service configuration of a computer, may it be the local computer or a remote one, to a text file.

To backup the configuration:

  1. Select the Computer for which you want to backup the configuration to a file.
  2. On the Action menu, select Backup, or right-click and select Backup.
  3. Specify the file to which the configuration should be saved, and click OK.


Restore Configuration

You can load the syslog service configuration of a computer, may it be the local computer or a remote one, from a text file.

To restore the configuration:

  1. Select the Computer for which you want to restore the configuration from a file.
  2. On the Action menu, select Restore, or right-click and select Restore.
  3. Specify the file from which the configuration should be loaded, and click OK.


Purge Hostname Cache

You can purge the hostname cache of a syslog service, may it be the local computer or a remote one.

To purge the hostname cache:

  1. Select the Computer for which you want to purge the hostname cache.
  2. On the Action menu, select Purge Hostname Cache, or right-click and select Purge Hostname Cache.


Configuring Syslog Service Properties Using Files

The configuration data of the syslog service is stored in the registry under the key HKLM\System\CurrentControlSet\Services\SL4NT\Parameters. The SL4NT Manager Snap-In reads/writes data from/to the registry when the properties of a syslog service instance are viewed/changed.

Instead of using the SL4NT Manager Snap-In for viewing/configuring the properties of a syslog service instance, it's possible to use a file-based approach by using configuration data files:

You can specify a configuration data source file which is monitored by the syslog service. When the syslog service detects changes to this file - this also implies file creation - the content of the file is read and saved to the registry. Afterwards the syslog service will reload its configuration from the registry.
To enable this feature, you must add a value (Name: ConfigurationDataSourceFile, Type: REG_SZ) under the registry key mentioned above. The data of this registry value is the name of the configuration data source file. If it is not a fully qualified file name, the file is assumed to be located in the <InstallDir\Bin> directory.
The file must contain the whole configuration of the syslog service: incremental changes to the syslog service configuration are not possible. Use a file generated by the Backup action or a configuration data destination file as a template for the configuration data source file.

It's also possible to specify a configuration data destination file to which the current syslog service configuration is written whenever the syslog service reloads its configuration from the registry.
To enable this feature, you must add a value (Name: ConfigurationDataDestinationFile, Type: REG_SZ) under the registry key mentioned above. The data of this registry value is the name of the configuration data destination file. If it is not a fully qualified file name, the file is assumed to be located in the <InstallDir\Bin> directory.

Note! The two registry values mentioned above must not point to the same file. If they do, the ConfigurationDataDestinationFile setting is ignored.


Send Syslog Message

Send Syslog Messages

To test or troubleshoot the configuration of a syslog service, you can generate syslog messages using the SL4NT Manager Snap-In by following the procedure described below.

To send syslog messages:

  1. Select the SL4NT item in the scope pane.
  2. On the Action menu, select Send Syslog Message, or right-click and select Send Syslog Message.
  3. Use the displayed dialog to send syslog messages:

Destination

Host
Hostname or IP address of the host to which syslog messages should be sent.
Port
UDP port to which syslog messages should be sent.

Message

Facility
Facility of the syslog messages to sent.
Priority
Priority of the syslog messages to sent.

Send Options

Number
Number of messages to send.
Delay
Delay in milliseconds between consecutive syslog messages.


Troubleshooting SL4NT

If you have trouble getting SL4NT to work correctly after installation, perform the following procedure:

Look in the Windows NT Application Event Log for events logged by SL4NT. If you cannot find events logged by SL4NT in the Application Event Log indicating an error, it could be that either no syslog messages are received or that syslog messages are received but no actions are executed. You can use the performance counters of the Syslog Service performance object to see which case is true:

Monitor the counter Total Messages Received with the Performance Monitor during a period where external syslog clients send syslog messages to the computer. You can also use the Send Syslog Messages feature of the SL4NT Manager to generate syslog messages.

If the counter Total Messages Received does not increase, no syslog messages are received and you should check your syslog message source(s) for correct configuration.

If the counter Total Messages Received does increase, messages are received and you should check your rule configuration to find out why no actions are processed.


Extending SL4NT

SL4NT can be extended by using custom extension objects which are implemented as ActiveX objects. SL4NT supports two different types of custom extension objects:

Custom Evaluator Objects

Custom evaluator objects implement the ISL4NTCustomRuleCondition interface and can be associated with rules. They can be used to read and write all information elements (including custom fields) of a syslog message and to control rule evaluation. For example, such an object could be used to parse the raw message text of a syslog message and store the decoded data in custom fields for further processing by actions.

Custom Action Handler Objects

Custom action handler objects implement the ISL4NTCustomAction interface and are used by actions of type Execute Custom Handler Action. They can be used to read (but not write) all information elements (including custom fields) of a syslog message and perform arbitrary processing on them.

There is a free Software Development Kit (SDK) available for anyone who wants to develop his own custom extension objects. This SDK contains files needed for developing extension objects in C++ (.IDL, .H), documentation and working samples in Visual Basic and Visual C++.

To download the SDK, please go to http://www.netal.com/sl4nt_sdk.htm.


Administrator’s Reference

Welcome to the Administrator’s Reference topics. This section provides detailed information about configuration properties for SL4NT. Use this information as a reference for administrative activities.

This section contains:

  • SL4NT Manager Property Sheets: Help topic content for all property sheets in the SL4NT Manager.
  • Performance Counters: Describes the available performance counter of the syslog service.


SSH Property Sheets

SL4NT Manager Property Sheets

The property sheets in the SL4NT Manager contain settings to configure computer settings.

This section contains:

  • About SL4NT Manager Property Sheets: Conceptual topics related to SL4NT Manager property sheets.
  • Computer Properties: Property sheets used to configure SL4NT service properties at the computer level.


About SSH Property Sheets

About SL4NT Manager Property Sheets

This topic contains conceptual information about SL4NT Manager property sheets

The following section describes how you should use the property sheets to properly configure SL4NT. The information provided reflects the context-sensitive Help that is provided for all property sheets. You can also access this information by clicking the Help button on any property sheet or any dialog box that is launched from a property sheet.

Note The information presented in this section is context-sensitive; that is, many concepts and procedures described in this section relate directly to specific actions that can be carried out in SL4NT Manager. The topics are not intended to be read as a stand-alone reference.

Viewing Property Sheets

To view property sheets in SL4NT Manager, select the a computer item and click the Properties button, or, on the Action menu, select Properties. You can also right-click the computer and select Properties.


Computer Properties

The Computer property sheet consists of:

  • Rules property page: Used for configuring processing rules.
  • Actions property page: Used for configuring actions.
  • Log Formats property page: Used for configuring log formats.
  • Receiver property page: Used for configuring the message receiver engine.
  • Viewer property page: Used for configuring the viewer server.
  • SMTP property page: Used for configuring the properties of the SMTP mailer.
  • Other Settings property page: Used for configuring miscellaneous settings.
  • Product Info property page: Used for viewing product and license information.


Rules Property Page

In this property page you administer processing rules.

You can create new rules by starting from scratch (Add, Insert) or by using an existing rule as a template (Copy). You can change rule definitions (Edit), delete rules (Remove), change the rule flags (Active Flag, Stop Flag) or the order of rule evaluation (Move Up, Move Down).

The current version of SL4NT supports up to 256 rules.

When a syslog message is received, all rules which have the active flag set are evaluated in the order listed. If a rule 'fires' (the rule conditions evaluate to true and the associated actions are executed) and the rule has the stop flag set, subsequent rules will not be evaluated.


Rule Definition Dialog

In this dialog you define the properties of a processing rule.

A rule consists of conditions against which a received syslog message is tested and action(s) initiated when the specified conditions are met.

IMPORTANT The description text must be unique in relation to all other rules.

Conditions:

Note To initiate the specified rule action(s) all conditions must evaluate to true.

Substring(s) in message
The content of this field depends on the setting of the Regular Expression check box.
If the Regular Expression check box is not selected, this field can contain one or more substrings. Substrings must be separated by a ; (semicolon). Spaces are considered as being part of the substring. A substring can be prefixed by a ~ (tilde). The condition is evaluated to true if all substrings without the prefix ~ and none of the substrings with the prefix ~ are contained in the message text of the syslog message.

If the Regular Expression check box is selected, this field can contain one regular expression, which is interpreted as a POSIX 1003.2 'extended' regular expression. The condition is evaluated to true if there is a match between the message text and the specified regular expression.

The setting of the Ignore Case check box specifies if substring search or regular expression matching is performed in a case-insensitive manner or not.

If this field is empty, this condition is implicitly evaluated to true.
Facility
The facility code of the syslog message must match one of the checked ones in order for this condition to evaluate to true.
Priority
The priority code of the syslog message must be within the specified min and max priority in order for this condition to evaluate to true.
Source
The IP address of the originating host of the syslog message must match or must not match, depending on the configuration, a specified single IP address in the list or must be contained within one of the specified IP address ranges in order for this condition to evaluate to true. If the list is empty, this condition is implicitly evaluated to true.

The current version of SL4NT supports up to 64 entries per rule.
Destination
The destination IP address and port number of the received syslog message must match the configured IP address and port number in order for this condition to evaluate to true. In the IP Address combo box you can either select one of the IP addresses of the computer SL4NT is running on, or you can specify Any or Loopback (=127.0.0.1). In the Port combo box you can select one of the port numbers the SL4NT receiver is listening on, or you can specify Any.
Receive Time
The time the syslog message was received must fall or must not fall, depending on the configuration, within one of the specified time periods in order for this condition to evaluate to true. If the list is empty, this condition is implicitly evaluated to true.

The current version of SL4NT supports up to 64 entries per rule.
Custom Evaluator
If a custom evaluator object is specified, it depends on the object if this condition will evaluate to true. If you want to use a custom evaluator object, you must either specify the ProgID (e.g.: "SL4NTCRCVB.CustomRuleCondition") or the ClSID (e.g.: "{620C280A-E75C-4055-8E19-93650A4F6C78}"). Depending on the custom evaluator object used, it may be necessary to specify a parameter string.

Actions:

The action list box contains references to zero or more actions to execute when all rule conditions evaluate to true. Those actions are either executed for each message which meets the rule conditions or one time for every x messages received within a time window of y seconds. Click Configure to specify the trigger threshold settings.

The current version of SL4NT supports up to 64 actions per rule.

See Actions for more information about actions.

Trigger Threshold Settings:

In this dialog you specify how many messages which meet the rule conditions must arrive within a time window to trigger execution of associated actions. Optionally you can specify that after action execution, rule evaluation should be suspended for a configurable interval.


Actions Property Page

In this property page you define the actions which are then assigned to rules.

You can create new actions by starting from scratch (Add) or by using an existing action as a template (Copy). You can change actions definitions (Edit) and delete actions (Remove).

The current version of SL4NT supports up to 256 actions.

When you create a new action (Add), you have to specify its type:

The current version of SL4NT supports nine action types:

  • Execute custom handler
  • Forward syslog message
  • Forward to viewer
  • Log to Event Log
  • Log to file
  • Log to ODBC database
  • Run program
  • Send e-mail message
  • Send network alert


Execute Custom Handler Action Definition Dialog

In this dialog you specify either the ProgID (e.g.: "SL4NTCAVB.CustomAction") or the ClSID (e.g.: "{749BC782-1C56-474A-AC7D-0B0AFDA49911}") of a custom action object. Depending on the custom action object used, it may be necessary to specify a parameter string.


Forward Syslog Message Action Definition Dialog

In this dialog you define the host name or IP address of the destination host to which the syslog message should be forwarded. You may optionally provide the destination port number. If the Port entry field is left empty, the Default Forwarder Destination Port value (see Receiver property page) will be used. Facility code, priority code and log format define the content of the syslog message which is sent to the destination host. The value <Derived> for the facility and priority code means that the values for facility and priority code of the received syslog message will be used.

If you specify <Derived> as value for the facility and priority code and Default Forwarded Syslog Message Format as log format, the syslog message which is forwarded to the destination host will be identical to the original one.


Forward to Viewer Action Definition Dialog

In this dialog you define the channel number to which a viewer application must be connected to receive the syslog message. The channel number can be any value between 0 and 4294967295.
The content of the string which is sent to connected viewers depends on the selected log format.

The viewer service, which is integrated with the SL4NT service, is a TCP-server, which is listening on the configured port (see Viewer property page). If a viewer application connects to the configured TCP-port, it gets implicitly connected to channel 0. The user of the viewer application can use input commands to select other channels, display the currently selected channels, display a list of all configured channels, display help information and terminate the TCP-connection.

The SL4NT viewer service supports the following commands:

#? | Display currently connected channels
#cl | Disconnect all connected channels and connect to channels in list cl
+#cl | Connect to channels in list cl
-#cl | Disconnect channels in list cl
HELP | Display this information
LCH | Display information about all configured channels
QUIT | Terminate connection

The parameter cl can be a single channel number (e.g.: 1), a channel number range (e.g.: 5-10), or a comma separated list of single channel numbers or channel number ranges (e.g.: 1, 3, 5-20, 50, 60-63, 100).

Up to 128 viewer applications can be connected to the viewer service at the same time.

As viewer application you can use every Telnet-like application (on Windows NT/2000/XP: Telnet.exe). You can run the viewer application locally or from a remote computer. You must provide the hostname/IP address of the computer SL4NT is running on and the TCP-port number on which the viewer service is listening (see Viewer property page).

The following picture shows a viewer session:


Log to Event Log Action Definition Dialog

In this dialog you specify the logfile and event type for an event log entry. The content of the event log entry will be constructed based on the selected log format.

The value <Derived> for Entry Type specifies an implicit mapping between the priority value of the received syslog message and the Event Log record type:

The priority codes EMERGENCY, ALERT, CRITICAL and ERROR map to the Event Log record type Error.
The priority code WARNING maps to the Event Log record type Warning.
The priority codes NOTICE, INFO and DEBUG map to the Event Log record type Information.

Note On Windows XP and Windows 2003 Server the Security logfile is for system use only and can no longer be used by SL4NT. The Security logfile can still be specified as the Destination Event Log but no entries will be written to this logfile.


Log to File Action Definition Dialog

In this dialog you specify the location and name of the log file to which the log entry will be written. The content of the entry will be constructed based on the selected log format.

The log file directory name must be either a fully qualified path of a directory located on a local fixed disk, or an UNC path.

Note If you specify an UNC path, you must assign a 'real' user account as the log-on account for the SL4NT service instead of the Local System account. The user account must have the user right Log on as a service and be a member of the user group Administrators.

Note The Browse button is only enabled if you are administering the local computer.


Log to ODBC Database Action Definition Dialog

In this dialog you define the name of an ODBC system data source, the name of the destination table, optional custom name mappings and, if required by the DBMS, the user name and password of an account which has sufficient rights to insert a new record into the table.

Prerequisites:

The installed ODBC Driver Manager must be of version 3.0 or higher.
The ODBC Driver used must be of version 2.5 or higher.
An ODBC data source must have been defined using the ODBC Data Source Administrator. The ODBC data source must be a System Data Source. A User Data Source cannot be used because SL4NT runs as a service.

Supported log columns:

The database table must contain at least one of the following columns:

Column Name1 | Short Column Name1 | Datatype | Recommended Size2
DateTimeLocal | DTLOC | DATETIME/TIMESTAMP | -3
DateTimeUTC | DTUTC | DATETIME/TIMESTAMP | -3
DateTimeRFC822Local | DTRFCLOC | CHAR or VARCHAR | 31
DateTimeRFC822UTC | DTRFCUTC | CHAR or VARCHAR | 31
IPAddressSource | IPASRC | CHAR or VARCHAR | 15
PortSource | PORTSRC | INTEGER | -3
HostnameSource | HNSRC | CHAR or VARCHAR | 2554
IPAddressDestination | IPADEST | CHAR or VARCHAR | 15
PortDestination | PORTDEST | INTEGER | -3
Facility | FAC | CHAR or VARCHAR | 9
FacilityCode | FACCODE | SMALLINT | -3
Priority | PRIO | CHAR or VARCHAR | 9
PriorityCode | PRIOCODE | SMALLINT | -3
MessageText5 | MSG | CHAR or VARCHAR or LONGVARCHAR | 2552
CustomFieldx 6 | CFx 6 | CHAR or VARCHAR or LONGVARCHAR | 507
  1. For every column you may either use the long or short column name. The short column names were introduced with v2.0 due to the fact that some DBMSs don't support column names as long as some long column names. Since SL4NT 3.0, it's also possible to use arbitrary column names by defining name mappings between the standard column names and your custom column names.
  2. If the string to be stored in the column is larger than the given column size it will be truncated.
  3. Not applicable because the storage size for this data type is defined by the DBMS.
  4. This column size guarantees that any valid host name could be stored in this column. Because host names are normally much shorter than the allowed maximum of 255 characters, a smaller column size will be sufficient in most cases.
  5. Some DBMSs limit the size of CHAR/VARCHAR columns to 255 characters. SL4NT however, supports a maximum message text size of 1024 characters for received syslog messages. In case that you are limited to a maximum size for CHAR/VARCHAR columns of 255 characters, it’s still possible to store message texts of up to 1024 characters by specifying multiple MessageText columns, whereas the character offset (zero-based) of the syslog message text to be stored in a column is appended to MessageText in the column name. For example:

    MessageText VARCHAR(250)
    MessageText250 VARCHAR(250)
    MessageText500 VARCHAR(250)
    MessageText750 VARCHAR(250)

    will allow up to 1000 characters of a syslog message text to be stored in the table record.
  6. x is a number between 1 and 16.
  7. Depending on your requirements, you may use any supported column size, but you should note that a custom field will never contain more than 1024 characters.

Custom name mappings

If you decide to use column names of your own choice, you must define mappings between the standard column names and your custom column names in the dialog shown above.

Other issues:

  • After extracting the package distribution file you will find a directory named Support. This directory contains four files:
    • CreateSyslogTable.sql: MS SQL-Server 2000 script for creating a table containing all supported columns except the CustomFieldx columns.
    • CreateSyslogTableWithCustomFields.sql: MS SQL-Server 2000 script for creating a table containing all supported columns.
    • Syslog.mdb: MS Access 97 database containing one table with all supported columns except the CustomFieldx columns.
    • SyslogCF.mdb: MS Access 97 database containing one table with all supported columns.
  • Please be aware of the fact that after installation the SL4NT service is executing in the security context of the Local System account. This may pose a problem if the DBMS used requires a validated network session (because it uses NT accounts for securing access to database objects). In this case, it may be necessary to assign a ‘real’ user account as the log-on account for the SL4NT service instead of the Local System account. The user account must have the user right Log on as a service and be a member of the user group Administrators.


Run Program Action Definition Dialog

In this dialog you specify the command line to be executed when this action is triggered.

Programs can access information elements of the syslog message through the following environment variables:

  • SL4NT_DATE_LOCAL
  • SL4NT_DATE_UTC
  • SL4NT_DATETIMERFC822_LOCAL
  • SL4NT_DATETIMERFC822_UTC
  • SL4NT_FACILITY
  • SL4NT_FACILITY_CODE
  • SL4NT_HOSTNAME_SOURCE
  • SL4NT_IPADDRESS_SOURCE
  • SL4NT_IPADDRESS_DESTINATION
  • SL4NT_MESSAGETEXT
  • SL4NT_PORT_DESTINATION
  • SL4NT_PORT_SOURCE
  • SL4NT_PRIORITY
  • SL4NT_PRIORITY_CODE
  • SL4NT_TIME_LOCAL
  • SL4NT_TIME_UTC
  • SL4NT_CUSTOMFIELDx (where x is a number between 1 and 16)

If you specify that the launched program should run synchronously, SL4NT will wait for program termination before starting the next program.

Programs are executed in the same security context in which the SL4NT service runs, which is by default the Local System account.

Note Don’t specify a program which expects input from the user!


Send E-Mail Message Action Definition Dialog

In this dialog you define the e-mail recipients (up to 64 recipients per action) to which an SMTP message should be sent and if the e-mail message should be sent as high priority mail. The content of the SMTP message depends on the selected log format.

Note The first text line (terminated by <CR><LF>) of the message content will be put into the subject line (up to 255 characters) of the SMTP message. The body of the SMTP message will contain all text lines except the first one.


Send E-Mail Message Action Definition Dialog

Send Network Alert Action Definition Dialog

In this dialog you define the network names (up to 64 alert names per action) to which an alert should be sent. The content of the alert message depends on the selected log format.

An alert name is case-insensitive (it’s always displayed in upper-case) and can be up to 15 characters long. An alert name can be

  • the name of a computer
  • the name of a network user
  • the name of a domain, in which case the alert is broadcast to all computers in the domain. The domain name must be followed by an * (asterisk) to constitute a valid alert name.

For a computer to be able to receive network alerts and display them in popup windows, it’s necessary that messenger support be enabled. This means that WinPopup must be running on Windows 9x/Me computers; and the Messenger service on Windows NT/2000/XP computers.

Note If the alert name specifies a user name and the user is logged in on more than one system at the same time, the alert will be sent to only one computer!


Log Formats Property Page

In this property page you can define custom log formats in addition to the six predefined ones.

Every action references a log format (except the Run Program Action, Log to ODBC Database Action and Execute Custom Handler Action type), which defines the information and the format of the data handled by an action.

See Log Format Definition for more information.

The description text must be unique in relation to all other log formats.

The current version of SL4NT supports up to 256 log formats.


Log Format Definition Dialog

A log format definition specifies which constant text and variable information elements of a syslog message will be processed as data by actions.

You can include non-printable characters as constant text by using the tag <%xx> where xx is the hex code of the character. For example: <%1B> specifies the ESCAPE character.

It's also possible to specify the output width for a data field. If this is desired, a format specification must follow the name of the data field, for example: <Facility%-10>.

A format specification has the following form:

%[-][width][.precision]

The value for width and precision must be in the range [ 0 - 99 ].

Field | Meaning
– | Pad the output with blanks or zeros to the right to fill the field width, justifying output to the left. If this field is omitted, the output is padded to the left, justifying it to the right.
width | Copy the specified minimum number of characters to the output buffer. The width field is a nonnegative integer. The width specification never causes a value to be truncated; if the number of characters in the output value is greater than the specified width, or if the width field is not present, all characters of the value are printed, subject to the precision specification.
.precision | Copy the specified maximum number of characters to the output buffer.


Ports Property Page

Receiver Property Page

In this property page you specify the UDP and TCP ports to use for receiving syslog messages.

UDP-Ports

List of UDP ports on which the receiver will listen for incoming syslog messages. The list can contain 1 to 32 ports but cannot be empty, e.g. at least one port must be specified.

Note Most syslog senders send messages to UDP port 514.

TCP-Ports

List of TCP ports on which the receiver will accept TCP connections from syslog senders for receiving syslog messages. The list can contain 0 to 32 ports.

Note If you intend to receive syslog messages from a Cisco PIX firewall using TCP, you should specify TCP port 1468.

Concurrent Connections
Here you can specify if the receiver will allow only a limited number of concurrent TCP connections.
Idle Connection Timeout
Here you can specify if the receiver will automatically terminate TCP connections that are idle for the specified interval.
Default Forwarder Destination UDP Port
UDP-port to which syslog messages are sent due to the execution of Forward Syslog Message Actions . You can overwrite this value in a specific Forward Syslog Message Action.


Ports Property Page

Viewer Property Page

In this property page you specify the UDP and TCP ports to use.

Enable viewer server

If this check box is enabled, the viewer server will be active and accept connection request from viewer clients.

TCP Port
TCP port on which the viewer server is listening for connection request from viewer clients.

Access Restrictions

These settings allow you to specify which viewer clients are allowed to connect to the viewer server. You have to specify a default (Granted Access or Denied Access) and the excepted IP addresses.


SMTP Property Page

In this property page you specify the properties for the built-in SMTP-mailer.

E-Mail (SMTP) Configuration

These properties are used whenever SMTP messages are sent due to the execution of Send E-Mail Actions .

SMTP Server
Hostname or IP address of the SMTP server to which to send SMTP messages.
Port
TCP port of the SMTP server to which to send SMTP messages.
Sender Address
SMTP-address of the built-in mailer. This address will be put in the "From:" field of SMTP messages to send.
Sender Name
Display name of the built-in mailer. This display name will be put in the "From:" field of SMTP messages to send.


Other Settings Property Page

In this property page you specify miscellaneous service properties.

Resolve IP address of originating host to its name

If this check box is enabled, SL4NT will perform reverse resolution of the source IP address of received syslog messages.

Cache resolved hostnames

If this check box is enabled, SL4NT will cache resolved IP address <-> hostname mappings. Please note that SL4NT implements negative caching, too.
Time-to-Live

Specifies for how long a resolved IP address <-> hostname mapping will be cached.

Date & Time Format Specification

These settings allow you to specify your own custom format for the DateLocal, DateUTC, TimeLocal and TimeUTC output fields.

If the Date format picture string is not specified, the DateLocal and DateUTC output fields are formatted according to the short date format of the system default profile.

If the Time format picture string is not specified, the TimeLocal and TimeUTC output fields are formatted according to the time format of the system default profile.

Date
Use the following elements to construct a date format picture string. If you use spaces to separate the elements in the format string, these spaces will appear in the same location in the output string. The letters must be in uppercase or lowercase as shown in the table (for example, "MM" not "mm"). Characters in the format string that are enclosed in single quotation marks will appear in the same location and unchanged in the output string.
Picture | Meaning
d | Day of month as digits with no leading zero for single-digit days.
dd | Day of month as digits with leading zero for single-digit days.
ddd | Day of week as a three-letter abbreviation.
dddd | Day of week as its full name.
M | Month as digits with no leading zero for single-digit months.
MM | Month as digits with leading zero for single-digit months.
MMM | Month as a three-letter abbreviation.
MMMM | Month as its full name.
y | Year as last two digits, but with no leading zero for years less than 10.
yy | Year as last two digits, but with leading zero for years less than 10.
yyyy | Year represented by full four digits.

For example, to get the date string

Wed, Aug 31 2000

use the following picture string:

ddd',' MMM dd yyyy
Time

Use the following elements to construct a time format picture string. If you use spaces to separate the elements in the format string, these spaces will appear in the same location in the output string. The letters must be in uppercase or lowercase as shown (for example, "ss", not "SS"). Characters in the format string that are enclosed in single quotation marks will appear in the same location and unchanged in the output string.

Picture | Meaning
h | Hours with no leading zero for single-digit hours; 12-hour clock.
hh | Hours with leading zero for single-digit hours; 12-hour clock.
H | Hours with no leading zero for single-digit hours; 24-hour clock.
HH | Hours with leading zero for single-digit hours; 24-hour clock.
m | Minutes with no leading zero for single-digit minutes.
mm | Minutes with leading zero for single-digit minutes.
s | Seconds with no leading zero for single-digit seconds.
ss | Seconds with leading zero for single-digit seconds.
t | One character time-marker string, such as A or P.
tt | Multicharacter time-marker string, such as AM or PM.

For example, to get the time string

22:29:40

use the following picture string:

HH':'mm':'ss

Service logging Level

Specifies which kinds of service operation events should be logged to the Windows NT Application Event Log.


Product Info Property Page

In this property page you can view product and license information.

How to Order
Activating this button will display information about license types and how to order them.
Enter License Data
Activating this button will display the following dialog:
In this dialog you enter the license data (name of licensee and key string) you received after purchasing one or more licenses for SL4NT. Entering the license data turns your evaluation copy of SL4NT into a licensed one.


Performance Counters

The operation of the service component of SL4NT can be monitored through application performance counters of the Syslog Service performance object. The following performance counters are available:

Name Description
Current Receiver TCP Connections | Current number of TCP connections established with the receiver.
Current Viewer Server TCP Connections | Current number of TCP connections established with the viewer server.
EventLog Action Queue Entries | Count of entries in Log-to-EventLog action queue, waiting to be processed.
EventLog Actions not successfully processed | Count of events not successfully written to the Event Log due to an error.
EventLog Actions Processed/Sec | The rate of processed Log-to-EventLog actions, measured in messages per second.
EventLog Actions successfully processed | Count of events successfully written to the Event Log.
ExecuteCustomHandler Action Queue Entries | Count of entries in Execute-Custom-Handler action queue, waiting to be processed.
ExecuteCustomHandler Actions not successfully processed | Count of messages not successfully processed by custom handler objects due to an error.
ExecuteCustomHandler Actions Processed/Sec | The rate of processed Execute-Custom-Handler actions, measured in messages per second.
ExecuteCustomHandler Actions successfully processed | Count of messages successfully processed by custom handler objects.
ForwardSyslogMessage Action Queue Entries | Count of entries in Forward-Syslog-Message action queue, waiting to be processed.
ForwardSyslogMessage Actions not successfully processed | Count of syslog messages not successfully forwarded due to an error.
ForwardSyslogMessage Actions Processed/Sec | The rate of processed Forward-Syslog-Message actions, measured in messages per second.
ForwardSyslogMessage Actions successfully processed | Count of syslog messages successfully forwarded.
ForwardToViewer Action Queue Entries | Count of entries in Forward-to-Viewer action queue, waiting to be processed.
ForwardToViewer Actions not successfully processed | Count of messages not successfully forwarded to viewers due to an error.
ForwardToViewer Actions Processed/Sec | The rate of processed Forward-to-Viewer actions, measured in messages per second.
ForwardToViewer Actions successfully processed | Count of messages successfully forwarded to viewers.
Hostname Cache Entries | Count of hostname-to-IP-address mappings in cache.
LogToFile Action Queue Entries | Count of entries in Log-to-LogFile action queue, waiting to be processed.
LogToFile Actions not successfully processed | Count of entries not successfully written to log files due to an error.
LogToFile Actions Processed/Sec | The rate of processed Log-to-LogFile actions, measured in messages per second.
LogToFile Actions successfully processed | Count of entries successfully written to log files.
LogToODBCDB Action Queue Entries | Count of entries in Log-to-ODBC-Database action queue, waiting to be processed.
LogToODBCDB Actions not successfully proc. | Count of entries not successfully written to ODBC databases due to an error.
LogToODBCDB Actions Processed/Sec | The rate of processed Log-to-ODBC-Database actions, measured in messages per second.
LogToODBCDB Actions successfully processed | Count of entries successfully written to ODBC databases.
Maximum Receiver TCP Connections | Maximum number of simultaneous TCP connections established with the receiver.
Maximum Viewer Server TCP Connections | Maximum number of simultaneous TCP connections established with the viewer server.
Messages Handled | Count of messages which met the conditions of one or more processing rules and which have been forwarded to one or more action type queues.
Messages Handled/Sec | The rate of messages which met the conditions of one or more processing rules and which have been forwarded to one or more action type queues, measured in messages per second.
Messages Not Handled | Count of messages which did not meet the conditions of one or more processing rules and which have not been forwarded to one or more action type queues.
Messages Not Handled/Sec | The rate of messages which did not meet the conditions of one or more processing rules and which have not been forwarded to one or more action type queues, measured in messages per second.
Received Messages Queue Entries | Count of entries in received messages queue, where they are put by the receiver thread. This queue is read by the message processor thread, which is responsible for rule evaluation.
RunProgram Action Queue Entries | Count of entries in Run-Program action queue, waiting to be processed.
RunProgram Actions not successfully processed | Count of programs not successfully started due to an error.
RunProgram Actions Processed/Sec | The rate of processed Run-Program actions, measured in messages per second.
RunProgram Actions successfully processed | Count of programs successfully started.
SendAlert Action Queue Entries | Count of entries in Send-Network-Alert action queue, waiting to be processed.
SendAlert Actions not successfully processed | Count of network alerts not successfully sent due to an error.
SendAlert Actions Processed/Sec | The rate of processed Send-Network-Alert actions, measured in messages per second.
SendAlert Actions successfully processed | Count of network alerts successfully sent.
SendEMail Action Queue Entries | Count of entries in Send-EMail-Message action queue, waiting to be processed.
SendEMail Actions not successfully processed | Count of e-mail messages not successfully sent due to an error.
SendEMail Actions Processed/Sec | The rate of processed Send-EMail-Message actions, measured in messages per second.
SendEMail Actions successfully processed | Count of e-mail messages successfully sent.
TCP Messages Received | Total count of syslog messages received from syslog clients over TCP.
TCP Messages Received/Sec | The rate of messages received from syslog clients over TCP, measured in messages per second.
Total Messages Received | Total count of syslog messages received from syslog clients over UDP and TCP.
Total Messages Received/Sec | The rate of messages received from syslog clients over UDP and TCP, measured in messages per second.
UDP Messages Received | Total count of syslog messages received from syslog clients over UDP.
UDP Messages Received/Sec | The rate of messages received from syslog clients over UDP, measured in messages per second.


License Information

This section provides detailed information about SL4NT licenses: license types and how to order licenses.

This section contains:

  • License Types: Describes the available product license types.
  • How to Order Licenses: Describes the process of ordering product licenses.


License Types

According to the End-User License Agreement ("EULA"), on expiration of the evaluation license after 60 days, you must either purchase a valid product license to convert the evaluation software into a commercial version or, as an alternative, completely uninstall the software.

Note A license for SL4NT is not bound to a specific version of the product. This means that if you license SL4NT, the acquired license is valid for the current and for future versions of the product.

You will receive license data (name of licensee and a key string) for every license you buy. You use those data to turn an evaluation copy of SL4NT into a licensed one.

There are three kinds of licenses for this product:

Single User license: | One single user license gives you the right to use SL4NT (Syslog Service) on one computer.
 | Price: $95
Site license: | A site license covers the use of SL4NT (Syslog Service) on an unlimited number of computers in a single organization within an area of up to one hundred miles (160 km) in radius.
 | Price: $595
World-wide license: | A world-wide license covers the use of SL4NT (Syslog Service) on an unlimited number of computers in a single organization.
 | Price: $2495

Note The SL4NT Manager product component may be installed and used on an unlimited number of computers, as long as you own at least one of the license(s) mentioned above.

Note To order licenses or to find detailed ordering information, please go to http://www.netal.com/sl4nt.htm.


How to Order Licenses

If you want to use SL4NT after the 60 day evaluation period, you must order one or more licenses.

To order licenses:

  1. Decide how many licenses of which type you need. See License Types for more information about these topics.
  2. Visit http://www.netal.com/sl4nt.htm to get detailed information about the ordering process and to order one or more licenses.
  3. After purchasing one or more licenses, you will receive per e-mail the license data for each license.
  4. Use the license data you receive to turn your evaluation copy of SL4NT into an licensed one. This is accomplished by using the Product Info property sheet.


End-User License Agreement

SL4NT Software License Agreement

IMPORTANT - READ CAREFULLY: This End-User License Agreement ("EULA") is a legal agreement between you (either an individual or a single entity) and Franz Krainer for the software product "SL4NT", which includes computer software and may include associated media, printed materials, and "online" or electronic documentation ("SOFTWARE PRODUCT"). By installing, copying, or otherwise using the SOFTWARE PRODUCT, you agree to be bound by the terms of this EULA. If you do not agree to the terms of this EULA, do not install or use the SOFTWARE PRODUCT.

The SOFTWARE PRODUCT contains some or all of the following types of software: "SYSLOG SERVICE" that provides the runtime environment for receiving and processing syslog messages ("Syslog Service"); "SUPPORT SOFTWARE" that contains components for administering the SYSLOG SERVICE ("SL4NT Manager & Documentation").

The SOFTWARE PRODUCT is licensed, not sold.

GRANT OF LICENSE

This EULA grants you the following rights to the SOFTWARE PRODUCT:

1. Installation. The SOFTWARE PRODUCT may be provided on multiple media such as CD-ROM or diskette(s) or may be obtained by "electronic software distribution" such as File Download from the Internet. The medium on which the SOFTWARE PRODUCT is provided may contain several copies of the SOFTWARE PRODUCT, each of which is compatible with different microprocessor architecture, (such as the x86 architecture or various RISC architectures). You may install the software from the provided media in the following manner:

2. SYSLOG SERVICE. You may install the SYSLOG SERVICE on the number of machines as specified in the product license you acquired.

3. SUPPORT SOFTWARE. You can install any component of SUPPORT SOFTWARE on an unlimited number of machines, as long as you own a license for at least one machine.

4. Evaluation. If you have installed the 'evaluation’ version of the software, you are using an evaluation license, which allows you to install the SYSLOG SERVICE on an unlimited number of machines for the purpose of evaluating the usefulness of the software. This evaluation license is valid for a limited number of days only. On expiration of the evaluation license, you must either purchase a valid product license to convert the evaluation software into the commercial version or alternatively completely 'uninstall' the SOFTWARE PRODUCT from all machines on which it was installed.

5. Upgrades. The SOFTWARE PRODUCT is stamped with a Version Code consisting of a major and a minor version number. An example of a Version Code would be "3.2". If you acquire a valid product license for any version of the SOFTWARE PRODUCT, you will be enabled to download later upgrades and enhancements from our Web Site for free. This means that SL4NT product licenses are version-independent.

6. Transfer. You may transfer the SYSLOG SERVICE to another computer, provided that it is removed from the computer from which it is transferred.

DESCRIPTION OF OTHER RIGHTS AND LIMITATIONS

7. For all SOFTWARE Rental. You may not rent or lease the SOFTWARE PRODUCT.

9. Limitation on Reverse Engineering, Decompilation, and Disassembly. You may not reverse engineer, decompile, or disassemble the SOFTWARE PRODUCT, except and only to the extent that such activity is expressly permitted by applicable law notwithstanding this limitation.

9. Termination. Without prejudice to any other rights, Franz Krainer may terminate this EULA if you fail to comply with the terms and conditions of this EULA. In such event, you must destroy all copies of the SOFTWARE PRODUCT and all of its component parts.

COPYRIGHT

10. The SOFTWARE PRODUCT is licensed, not sold. Title and copyrights in and to the SOFTWARE PRODUCT (including any images, applets, photographs, animations, video, audio, music, and text incorporated into the SOFTWARE PRODUCT), accompanying printed materials, and any copies you are permitted to make herein are owned by Franz Krainer or his suppliers and are protected by Austrian copyright laws and international treaty provisions.

DISCLAIMER OF WARRANTY

11. THIS SOFTWARE AND ITS ACCOMPANYING WRITTEN MATERIALS ARE PROVIDED BY LICENSOR "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT, ARE DISCLAIMED.

12. IN NO EVENT SHALL LICENSOR OR ITS SUPPLIERS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, SAVINGS, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

Because some states do not allow the exclusion or limitation of liability for consequential or incidental damages, the above limitation may not apply to you.

© Franz Krainer 1997-2005. All Rights Reserved. Legal Notices

2005-02-11


Acknowledgements

Regular expression support is based on Henry Spencer’s RegEx package (alpha3.8). We want to thank him for making this great piece of software available for public use.