Topic
This article provides support if you experience performance issues with message logging on your monitored endpoints.
Environment
NinjaOne Network Management System (NMS)
Possible Causes and Solutions
Possible reasons for this issue are listed below. If none of the solutions provided resolve the issue, please collect logs and send them to NinjaOne Support; you can find instructions to do so here (under Collect Logs).
- The device sending syslog information does not point to the NMS manager IP or is sending data on the wrong port (i.e., any other port than 514).
- The listening port (514) might not be listening under the nmsmanager.exe process.
- The endpoint is sending a Facility or Severity that the NinjaOne server discards by default
- A firewall is blocking the syslog traffic from reaching the NMS device
- Syslog is disabled at the policy level in NinjaOne
The device sending syslog information does not point to the NMS manager IP or is sending data on the wrong port (i.e., any other port than 514).
How to check: Log in to the NMS device and make sure the syslog settings are correct.
The listening port (514) might not be listening under the nmsmanager.exe process.
How to check: On the machine running the NMS manager delegate, open the system command prompt and run the following:
netstat -anop udp
Verify the process identification number (PID) for port 514 (local address) matches the one associated with the nmsmanager.exe process.
Figure 1: Match PID in command prompt to PID in task manager
The endpoint is sending a Facility or Severity that the NinjaOne server discards by default
How to check: Install and run Wireshark on the device running NMS delegate and filter by syslog traffic; take note of the facility and severity of the messages that come in.
As a workaround to receive the messages in NinjaOne, add the "Syslog" condition to the NMS policy with "user-level messages" for Facilities and "Notice" for Severities. NinjaOne issues a warning when each of those facilities and severities are added to the condition.
Figure 2: NinjaOne → Administration → Policies → NMS policy configuration page → Conditions
A firewall is blocking the syslog traffic from reaching the NMS device
How to check: Create an explicit rule that permits syslog traffic to flow from the NMS device to the NMS delegate.
Syslog is disabled at the policy level in NinjaOne
How to check: Go to the policy associated with the device and review the Syslog section. Verify the settings are correct and the Enabled toggle is active.
Figure 3: NinjaOne → Administration → Policies → NMS policy configuration page → Syslog