This article lists what is new in Syslog Watcher 7 compared with version 6.5. Use it to see the difference. It covers only the major improvements, not a full list of the syslog server features.
Dedicated Syslog Collector
The syslog collector is now a dedicated Windows service, separate from Syslog Watcher Server and from Syslog Watcher Manager. Incoming syslog messages are written to the storage even if the Server is stopped — for example during an upgrade. That split increases performance and improves reliability.
Remote Server Access
Version 7 adds remote Manager access to Syslog Watcher Server. A workstation can connect over the network to administer and configure the installation, inspect and analyze stored messages, and work with reports. The connection supports encryption. Role-based accounts can be limited to read-only inspection of collected messages, with no permission to change configuration.
Scheduled Syslog Reports
Syslog Watcher 7 can generate reports on a schedule. A schedule can be a one-time run or a recurring, weekly, or monthly pattern, and several reports can run independently. Syslog Watcher Server produces each report without an interactive Manager session. When a run finishes, the Server writes an HTML or text file to the output folder; you can open that file from Scheduled Reports.
Features as Server Workers
A feature is a background processor inside the Server. Each one reads messages from the syslog storage, applies a filter, and sends matches to files, an ODBC database, another syslog server, email, HTTP, or an external program.
Each feature can be suspended and resumed without deleting it. Suspend keeps the last processed timepoint. On resume you can continue from that point (including the backlog written while it was idle), skip ahead and process only new messages, or start from a chosen date and time.
Execute Program/Script
A new feature type starts a program or script for each matching message. The command line can include message fields. Typical uses are a PowerShell or batch script, a vendor CLI, or an in-house tool that has no syslog, file, or HTTP interface.
Send HTTP Requests
A new feature type sends one HTTP request (POST or PUT) for each matching message. Named endpoints in Server Configuration hold the host, TLS, and authentication. The feature supplies the path and the body, including JSON. Use it for webhooks, ticketing APIs, and similar HTTP integrations.
Storage Tab with Calendar
The new Storage tab gives a high-level view of collected syslog. It shows the structure of the syslog store and how messages are distributed — by calendar interval and by syslog originators. That makes it easier to locate the source of a problem.
Persistent View Tabs
Tabs that include a syslog query and an adjusted view layout persist after Manager restarts. The tabs are stored on the Server and remain available when you connect remotely from another location.
Clearer Filter Row on the Viewer
Version 7 adds a filter row on the viewer grid. Filtering is more convenient and visually clearer: you see the conditions on the grid and can adjust them there.
View Presets for Frequent Searches
Syslog Watcher 7 adds view presets — saved favorites for search and message requests you use often. Apply a preset instead of rebuilding the same Filter/Search each time.
Redesigned Parser Editor and Built-in Parsers
Version 7 redesigns the syslog parser with more settings and a clearer editor, so you can tailor parsers to your environment. The installer includes more built-in parsers, and that set will grow. This release ships parsers for Cisco, Fortinet, Juniper, Netgear, Palo Alto, SonicWall, Sophos, and Ubiquiti.
Field Collections for Unnamed Values
Syslog Watcher 7 adds field collections. Many vendors do not put field names in the syslog text — the payload is only a set of values. A field collection identifies those values as named fields so they can be used in filters, exports, and other processing.
Field Modifiers and Export Escapers
Version 7 adds new field modifiers for extracting useful data from syslog text, along with new escape modifiers for export formats. Escaping improves the security of those integrations: special characters in syslog text do not break the output.
Custom Facility and Severity Labels
Syslog Watcher 7 lets you customize facility and severity names. The syslog numbers stay the same; the labels can match your site or the vendor.
Incoming Filter with Regular Expressions
Version 7 extends the incoming filter. It still discards traffic before storage by severity and keywords, and it now also accepts a regular expression. Discarded messages take no storage and are not processed further.
10x Faster Regex Engine
Syslog Watcher 7 replaces the regular expression engine. Existing patterns in filters, field extraction, and parsers run faster, and you do not have to rewrite expressions.
TLS Certificate Manager
TLS configuration is often hard to follow because of the number of options. Version 7 makes that work simpler and clearer: a certificate manager can generate, import, and export certificates for the syslog server.
TLS Client Names and Fingerprints
Syslog Watcher 7 records new TLS clients and lists their certificate names and fingerprints. You can add an entry to the allow list from that record instead of copying values by hand.
Storage Structure for High Load
The version 7 storage layout addresses bottlenecks from version 6.5 and is better suited to high load. Time zone handling is also improved.
Built-in Storage Write Benchmark
A built-in disk benchmark measures how fast syslog storage can write on this system. Use it to estimate hardware requirements and to understand the limits of the I/O subsystem.
Storage Archive Sync Scripts
Syslog Watcher 7 can run a script when syslog archive sync completes. Use that to hand the archive to another tool — for example to copy it to a remote or cloud location.
Email Notification of Syslog Watcher Problems
Version 7 adds email notification when Syslog Watcher itself has a problem — the collector, the Server, or a failed feature. IT staff can respond before an error state stops collection and leaves gaps in the log.
Seamless Migration from Version 6
Syslog Watcher 7 migrates a version 6 installation on the same computer: license, configuration, forwarders (as features), Knowledge Base files, filter lists, view layouts, and report templates. Manager can also open version 6 syslog storage, so existing messages do not have to be copied.
System Requirements
Syslog Watcher 7.0 requires Windows 10 or Windows Server 2016 or later (64-bit). Windows 7 and Windows Server 2012 are not supported.
Download the installer from Downloads. The User Guide 7.0 covers collector, Server, features, and remote Manager access in detail.
Patch-level changes are listed in Syslog Watcher 7.0 - Version History.