Getting started with Syslog Manager

Requirements

• Windows Server 2019 or later, or Windows 10 / 11 (64-bit).
• ASP.NET Core Runtime 8.0.x (Hosting Bundle) — the new-installation file installs it for you if it is missing. If you use the smaller update file instead, install it first from dotnet.microsoft.com.
• Administrator rights to run the installer.
• An SSD for the data directory is strongly recommended. See Sizing for CPU, RAM and disk.

Install

1. Download the new-installation file from the Updates page (for an existing install, use the update file instead) and, optionally, verify its SHA-256:

   certutil -hashfile VSoftSolSyslogManagerInstall-1.1.2.exe SHA256

   These installers are not code-signed yet, so Windows may show an “Unknown publisher” warning — checking the hash is how you confirm the file is genuine.
2. Run it and approve the administrator prompt. It installs to C:\Program Files\VSoftSol Syslog Manager, creates the data directory at C:\ProgramData\Vision Software Solutions\VSoftSol Syslog Manager (restricted to the service account and Administrators), registers one Windows Service, and opens three firewall rules: UDP 514, TCP 514 and TCP 5443.
3. Open the dashboard at https://<this-server>:5443. Your browser will warn about the self-signed certificate on first visit — that is expected; see HTTPS certificate to replace it.

First run

The first visit opens a five-step wizard. It can’t be skipped or re-run once finished, so take a moment on each step:

1. Administrator password for the first account.
2. Listener ports — syslog UDP, syslog TCP and HTTPS dashboard (defaults 514 / 514 / 5443).
3. Data directory — shown for confirmation; the installer has already set it up with the correct permissions.
4. Retention preset — Small, Medium or Large, with a disk-usage estimate.
5. Vendor configuration bundle — optional.

After the wizard, the Waiting for messages page shows copy-ready configuration commands for your devices, with this server’s address and port already filled in. The dashboard opens automatically the moment the first message arrives.

Connect devices

Any device that speaks RFC 3164 or RFC 5424 syslog is supported for collection — point it at this server’s address on the UDP or TCP port you chose. Messages are never rejected for coming from an unrecognised vendor: they’re stored raw and remain fully searchable.

Vendors parsed out of the box

Cisco IOS/IOS-XE · Cisco ASA · Fortinet FortiGate · Palo Alto PAN-OS · Juniper JunOS · MikroTik RouterOS · Ubiquiti UniFi · Linux (sshd, sudo, cron, kernel) · Check Point Gaia · Sophos XG/XGS · SonicWall SonicOS · pfSense · OPNsense · Aruba (AOS-Switch and AOS-CX) · Huawei VRP · VMware ESXi.

Adding your own device

Open Settings → Pattern tester with a real sample message, build a GROK or regex extractor, and save it. It applies to every new matching message — no code change, no new release — and its fields become searchable as field.<name>.

Search basics

• Bare words search message text: failed login
• Quoted phrase for an exact match: "authentication failure for user root"
• Field filter: host:web01, with a trailing wildcard: host:web0*
• Boolean logic: severity:error AND (host:web01 OR host:web02)
• Ranges: severity:<=warning, received:>-1h (last hour), event_id:>10000

Common fields: message, raw, host, source_ip, app, severity, facility, vendor, protocol, parse_status, device, stream, received, event_time. Leave the box empty to match everything. Any result set can be exported as CSV, JSON or raw text.

Ports & firewall

A listener change binds the new port before closing the old one, so a mistyped or already-used port is refused and the previous port keeps running. To change the dashboard port:

{
  "Ingestion": { "UdpPort": 1514, "TcpPort": 1514 },
  "Kestrel": { "Endpoints": { "Https": { "Url": "https://0.0.0.0:8443" } } }
}

Upgrading

Download the small Update file (VSoftSolSyslogManagerUpdate-1.1.2.msi) from the Updates page and run it as Administrator directly over the existing install — no need to uninstall first. The service is stopped and restarted automatically; expect a gap of a few seconds to low tens of seconds in collection, so schedule upgrades outside your busiest period.

Checking for new versions: nothing updates itself. New releases are listed on the Updates page and on GitHub. The installers are not code-signed yet, so Windows may show an “Unknown publisher” prompt — compare the file’s SHA-256 with the value published on the Updates page before running it.

Backup & restore

All product state lives in the data directory, so backing it up captures everything. Stop the service first for a guaranteed-consistent copy (typically well under a minute). Run in PowerShell as Administrator:

Stop-Service "VSoftSol Syslog Manager"
$stamp = Get-Date -Format "yyyyMMdd-HHmmss"
$dest  = "D:\Backups\vsoftsol-$stamp"
robocopy "C:\ProgramData\Vision Software Solutions\VSoftSol Syslog Manager" $dest /E /XD spill /R:2 /W:5
Start-Service "VSoftSol Syslog Manager"

To restore, reverse it:

Stop-Service "VSoftSol Syslog Manager"
Remove-Item "C:\ProgramData\Vision Software Solutions\VSoftSol Syslog Manager\syslog.db*" -Force
robocopy "D:\Backups\vsoftsol-20260101-020000" "C:\ProgramData\Vision Software Solutions\VSoftSol Syslog Manager" /E /R:2 /W:5
Start-Service "VSoftSol Syslog Manager"

For a lighter-weight copy of your configuration only (rules, streams, devices, users, dashboards, reports, parser packs), use Settings → Config bundles → Export.

HTTPS certificate

On first start the service generates a self-signed certificate so the dashboard works over HTTPS immediately. For anything beyond evaluation, replace it with one from your organisation’s CA:

1. Export a certificate and private key for this server’s hostname as a .pfx file.
2. Stop the service.
3. Replace <data directory>\certs\web-https.pfx with your file, keeping the exact filename.
4. Start the service.

The service never overwrites an existing certificate — it only generates one when the file is missing.

Sizing

Planning figures assume 5 events per minute per device and 300 bytes per stored message. Once real traffic is flowing, Settings → Retention shows a measured estimate — trust that over this table.

Measured on a 2-vCPU VM, the full pipeline with all 17 vendor packs processes about 7,300 messages per second — far above typical sustained load. Bursts are absorbed by a disk-backed spill queue without losing messages.

Troubleshooting

The service won’t start

Check the Windows Event Log (Application log, source “VSoftSol Syslog Manager”). The usual causes are a missing or wrong-version ASP.NET Core Runtime, a configured port already in use, or data-directory permissions changed outside the installer (repair the installation from Programs and Features).

The dashboard is unreachable but the service is running

Confirm the firewall rule exists and that you’re browsing to the right port:

Get-NetFirewallRule -DisplayName "*VSoftSol*"

No messages are arriving

Check the device is sending to this server’s address and the configured port, that Windows Firewall allows the syslog port, and that the device’s own ACLs permit outbound traffic to this server.

A message arrived but isn’t parsed

It’s still stored and searchable, raw text intact, in the built-in Parse Failures stream. Add a pattern with the Pattern Tester (see Connect devices).