Sentinel: Syslog java error on Windows host

  • 3663338
  • 06-Dec-2006
  • 26-Apr-2012


Microsoft Windows Server 2003 Standard Edition
Microsoft Windows 2000 Server
Sentinel 5.1.x


Why am I getting a syslog java error on my Windows host?

C:\ProgramFiles\esecurity5.1.0.0\wizard\syslog>java -jar syslogconnector.jar -id test

java.lang.NoClassDefFoundError: javax/xml/parsers/ParserConfigurationException
at java.lang.Class.getField0(Native Method)
at java.lang.Class.getDeclaredField(Unknown Source)
at$ Source)
at Method)
at Source)
at Source)
at Source)
at Source)
at Source)
at Source)
at Source)
at Source)
at Source)
at esecurity.syslog.connector.SyslogTCPMessenger.readMsg(Unknown Source)
at esecurity.syslog.connector.SyslogTCPMessenger.start(Unknown Source)
at esecurity.syslog.connector.SyslogConnector.startConnector(Unknown Source)
at Source)

C:\Program Files\esecurity5.1.0.0\wizard\syslog>

ESEC_CONF_FILE=C:\Program Files\esecurity5.1.0.0\configuration.xml
ESEC_HOME=C:\Program Files\esecurity5.1.0.0
ESEC_JAVA_HOME=C:\Program Files\esecurity5.1.0.0\Sun-1.4.2\bin
HOMEPATH=\Documents and Settings\Administrator
MIBDIRS=C:\Program Files\esecurity5.1.0.0\wizard\mibs
Path=C:\oracle\ora92\bin;C:\Program Files\Oracle\jre\1.3.1\bin;C:\Program Files\
Oracle\jre\1.1.8\bin;C:\Program Files\esecurity5.1.0.0\wizard\dlls;C:\Program Fi
les\esecurity5.1.0.0\Sun-1.4.2\bin\server;C:\Program Files\esecurity5.1.0.0\Sun-
1.4.2\bin;C:\Program Files\esecurity5.1.0.0\wizard;C:\Program Files\esecurity5.1


  1. Make sure that you're using the "right" version of the java executable. It looks like you have an earlier version of the JRE in your path that might be defaulted to (the Oracle directory listed in the PATH variable seems to have 1.3.1). Instead, try using the following command: "%ESEC_JAVA_HOME%\java" -jar syslogconnector.jar -id test
  2. Bind the syslog.jar to the external IP address, instead of the loopback ( Point the syslogconnetor to the IP address. In some cases, you have to bind the syslog.jar service to another interface than the standard one. In some cases there may need to have the local and client's loopback bind.
  3. Your syslog service is listening on port 9091 for the IP Address on that box NOT the local loopback interface. By not specifying an IP address to connect to the Java connection is defaulting to local loopback. Try specifying the -proxy IP ADDR:9091 for that box.