XMA: Critical Msg:Syslog Sender SLSENDER Unable to send messages to host

XMA: Critical Msg:Syslog Sender SLSENDER Unable to send messages to host

Wait for the HKEEPER to delete the records based on the maximum age of not sent messages to be retained or use the following SQL queries to identify and delete or change the relevant records.

Show ?stuck? records and allow them to be deleted or changed:

To get the host names and port numbers with failing messages, and number of messages waiting in queue to be sent:

SELECT TARGET_HOST, TARGET_PORT, COUNT(*)
  FROM =XMA_SYSLOGQ            
 WHERE ALERTEDGMT = TIMESTAMP "1970-01-01:00:00:00.000000"   
GROUP BY TARGET_HOST, TARGET_PORT                            
BROWSE ACCESS;                                                

Replacing the = by > will return the counts of successfully sent messages by destination.

To delete not sent messages for a given destination:

DELETE FROM =XMA_SYSLOGQ 
 WHERE ALERTEDGMT = TIMESTAMP "1970-01-01:00:00:00.000000"
   AND TARGET_HOST = "192.168.1.123" 
   AND TARGET_PORT = 514;

To forward not sent messages from a given destination to a different one:

UPDATE =XMA_SYSLOGQ SET TARGET_HOST = "192.168.1.321",
                        TARGET_PORT = 1514 
WHERE ALERTEDGMT = TIMESTAMP "1970-01-01:00:00:00.000000"   
   AND TARGET_HOST = "192.168.1.123"
   AND TARGET_PORT = 514;


If this article did not provide a solution, please open a case with our support team by sending an email message to support@xypro.com.

    • Related Articles

    • XMA: SLSENDER Error unable to send messages to host.

      The SYSLOGQ database table in the XMADAT subvolume has 2 columns that can be used to determine if messages are being sent to the SIEM. ENTRYGMT is the timestamp when the message was inserted into the queue by a mover. ALERTEDGMT is the timestamp when ...

    • XMA: Send XMA messages to SIEM via HPE SSL proxy

      Step 1: initiate an HPE SSL proxy if the HPE SSL Proxy is not running - Mode: PROXYC - SUBNET: the name of the TCPIP stack - PORT: HPE SSL proxy client port, this is the same as the port specified next to the IPALERT_PORT entry in the FILTER ...

    • XMA: How to uninstall SLSENDER.

      As the SLSENDER is configured and added to the XMA pathway when the customer follows the installation process in the XMA manual. The following procedure can be used to manually stop the SLSENDER , remove any records that have been generated, and stop ...

    • Is there an RFC standard format for XMA syslog messages?

      XYGATEMA does not follow a RFC standard format for delivering syslog messages. XMA builds the messages based on the ALERTSTRING configuration for each filter that is added to the FILTERS. The FILTERS file is located in the XYGATEMA installation ...

    • XMA: How to optimize SLSENDER to handle multiple SIEMs

      SLSENDER must be optimized for the number of SIEMS and transactions 1. SLSENDER can be configured in XMA_MANAGER. >run xma install >XMA_MANAGER >2: Movers >18: Configure SysLog Send server) 2. In the SysLog Send server menu (SLSENDER), the Max Number ...