How to install a syslog server on Windows Server

These steps install Syslog Watcher 7 on Windows Server, including Server 2025. They cover the installer, the firewall rule, the first start of the collector, and a test message. For what a Windows syslog server is, see What is a Windows syslog server?

Five minutes to the first message

Once the installer is on the server, a local test takes about five minutes:

  1. Run the MSI and accept the EULA.
  2. Confirm the UDP 514 firewall rule the installer created.
  3. Start Syslog Watcher 7 Collector once.
  4. Send one UDP message to port 514.
  5. Read that message on the Last 15 Minutes tab.

Pointing every firewall and switch at the server takes longer. Those five minutes show that the server is listening.

What you need

  • Operating system. 64-bit Windows Server 2012 R2, 2016, 2019, 2022, or 2025. Windows 8.1, 10, and 11 are supported. A server OS is a better host when the machine must stay on.
  • Account. A local administrator, to install and to start the service.
  • Address. A static IPv4 address that your devices can route to.
  • Hardware. 64-bit CPU at 1 GHz, 512 MB RAM for Syslog Watcher itself. See hardware requirements.
  • Network. The installer adds a UDP listener on 0.0.0.0 port 514, and it creates the inbound Windows Firewall rule for that listener. Devices must be able to reach that address.

The same 7.0 installer is used on supported servers, desktops, and on virtual machines (Hyper-V, VMware, Azure, AWS).

Download the installer

Download the current Syslog Watcher 7 MSI from Downloads. The steps below stay the same for later 7.0 builds. On the server, compare the file’s hash with the SHA-256 published on that page. Run this in PowerShell:

Get-FileHash .\SyslogWatcherSetup-7.0.5-win64.msi -Algorithm SHA256

The MSI is signed. The Downloads page links the VirusTotal result for the published file.

Install Syslog Watcher

  1. Sign in to the server as an administrator.
  2. Run the downloaded MSI.
  3. Accept the EULA.
  4. Keep the default folder unless you have a reason to move it, and finish the wizard.

You do not need a license key to collect. The installer includes a Free License: 3 originators and 5,000 messages per hour. A larger license can be evaluated for 30 days from Manager: Server toolbar → Licenses → Request Evaluation.

The collector does not start at the end of setup. That first start is manual, so you can confirm the firewall rule and check the listener before messages arrive. See Start the collector. Setup also creates a Last 15 Minutes tab in Manager. That is where the test message shows up.

A UDP listener on all IPv4 addresses (0.0.0.0), port 514, is already in the configuration. TCP and TLS listeners are not. Add those later under Network Interfaces if a device needs them. Port 6514 is the usual port when you add TLS.

Confirm UDP 514

The installer creates the inbound Windows Firewall rules for the syslog listeners. A new install includes the allow rule for UDP 514, so you confirm it rather than create it.

Open Windows Defender Firewall with Advanced Security and select Inbound Rules. Find the inbound rule for UDP port 514. It should be enabled, its action should be Allow, and its profile should match the server’s adapter. A Domain-only rule does not cover an adapter on the Public profile. That is common when the server is not joined to a domain.

Add a rule only when you do not see that rule, for example, after a firewall policy removed the installer’s rule. This is the command from the collector troubleshooting guide:

netsh advfirewall firewall add rule name="Syslog UDP 514" dir=in action=allow protocol=UDP localport=514

That command applies to the Domain, Private, and Public profiles. In the GUI, the same change is: Windows Defender Firewall with Advanced Security → Inbound Rules → New Rule → Port → UDP 514 → Allow the connection, on the profiles the server uses.

TCP 514 and TLS 6514 are not default listeners. When you add one later under Network Interfaces, confirm an inbound allow rule exists for that port as well.

Start the collector

Open Syslog Watcher Manager on the server. On the Server toolbar, click Collector → Start Syslog Collector.

From an administrator Command Prompt:

net start SW7Collector

Confirm the service and the socket in PowerShell, not in Command Prompt:

Get-Service SW7Collector
Get-NetUDPEndpoint -LocalPort 514 | Select-Object LocalAddress, LocalPort

SW7Collector should be Running. Get-NetUDPEndpoint should show 0.0.0.0 and port 514.

Test-NetConnection -Port 514 checks TCP. It does not prove that UDP 514 is listening. Use Get-NetUDPEndpoint for the default listener.

Send a test message

Send the first message from the server itself. Run this in PowerShell, not in Command Prompt. Localhost does not cross the firewall, so this only proves the collector is up:

(New-Object Net.Sockets.UdpClient('127.0.0.1', 514)).Send([char[]]'<134>Test', 9)

The 9 is the number of characters in <134>Test. In Manager, open the Last 15 Minutes tab. Setup creates that tab. You should see Test from this computer.

Then repeat the send from a second computer, with the server’s IPv4 address in place of 127.0.0.1. That packet does cross the firewall. If the local test works and the remote test does not, the collector is listening. The packet is blocked on the way, or the firewall rule is blocking it.

Point a device at the server

Use the server’s IPv4 address and UDP 514. Replace 10.0.0.10 in each example. Syslog Watcher 7 ships parsers for Cisco, Fortinet, Juniper, Palo Alto, SonicWall, Sophos, and Ubiquiti, so those messages can be split into fields after they arrive. Other devices use the same destination IP and port. They appear under originators when automatic adding is on.

FortiGate

config log syslogd setting
    set status enable
    set server "10.0.0.10"
    set port 514
end

Menu names differ by FortiOS. The setting is remote syslog to that IP and UDP port.

Cisco IOS

On IOS and IOS-XE, logging host sends UDP to port 514:

configure terminal
logging host 10.0.0.10
logging trap informational
end

logging trap informational sends informational messages and anything more severe. Save with write memory when the messages show up on the Last 15 Minutes tab.

Install on a server with no internet

Setup does not need a network connection.

  1. Download the MSI on a computer that has internet.
  2. Copy it to the server with a USB drive, a file share, or the method you already use to copy files to that server.
  3. Run the MSI on the server and finish the wizard in Install Syslog Watcher.
  4. Confirm the UDP 514 rule, start the collector, and send the localhost test. Those steps stay on the server.

The Free License is active when no other license is selected, so an offline server can collect immediately.

A paid key is installed from Manager: Server toolbar → Licenses → Install License → License Key. If the license server cannot be reached, Manager shows a request link. Open that link on a computer that has internet, save the .txt file it returns, carry the file back, and install it with Install License → License File. The full sequence is in License Management.

When nothing arrives

Start at the top of this list. The first three are the usual causes.

  • The collector was never started. Setup leaves SW7Collector stopped. Start it from Manager or with net start SW7Collector.
  • UDP 514 is blocked. The localhost test works and a test from another computer does not. The installer already added the allow rule. Confirm it is still enabled and that its profile matches the server’s adapter. If a policy removed it, add it again with the netsh command in Confirm UDP 514.
  • The device is sending to the wrong place. It can use an IP address, a hostname, or a DNS name, with port 514. The default listener is 0.0.0.0, which is IPv4. An IPv6 destination will not hit it. A hostname only works when it resolves to this server.
  • Something else already owns port 514. Diagnostic Records show Failed to create interface … Error 10048. Find the other process with netstat -ano, then stop it or change the collector port. An old syslog program often still holds UDP 514.
  • The message was received and then discarded. The Received counter increases, but Last 15 Minutes stays empty. The incoming filter is dropping them. Check Incoming Filter. The default tab only shows the last 15 minutes, so a message older than that is in storage and not on that tab.
  • The collector will not stay running. Open Diagnostic Records. A storage path the service account cannot write is a typical cause. The collector runs as Local System, which can write to a local disk and usually cannot write to a network share.

More checks are in collector troubleshooting.

Install checklist

Tick these on the server. The install is finished when every box is checked.

Questions

Does Windows Server include a syslog server?

No. Windows Server has no syslog server role, including Windows Server 2025. Install Syslog Watcher to receive syslog.

Which port does Syslog Watcher use?

A new install listens on UDP 514, on all IPv4 addresses. TCP is optional and is added in Network Interfaces. TLS is also optional. When you add a TLS listener, port 6514 is the usual port.

Does the collector start when setup finishes?

No. Setup registers Syslog Watcher 7 Collector and sets it to start on the next boot, but the service stays stopped until you start it once. In Manager, use Server toolbar → Collector → Start Syslog Collector. After that, Windows starts it on reboot.

Can I install a syslog server with no internet access?

Yes. Copy the MSI to the server and run it. The Free License works with no license file. For a paid key, start Install License → License Key on the server, open the request link on a computer that has internet, and bring the .txt file back.

What to do next

Point the rest of the devices at this server the same way as the first one: its IPv4 address and UDP 514. When you want a copy of the archive off the server, follow How to collect syslog messages to cloud storage (S3).

The Syslog Watcher 7.0 user guide is the reference for listeners, TLS, filters, and licenses. Download Syslog Watcher.