Reference

Troubleshooting¶

Common failures and how to resolve them. If something here doesn't match what you're seeing, check the application logs first — they're the single best source of truth.

Service won't start¶

Port already in use¶

Another process is binding 514 or 5000.

netstat -ano | findstr :5000
netstat -ano | findstr :514

sudo ss -tulnp | grep -E ':514|:5000'

Stop the conflicting process or change the LuceDev port in Settings → Server (then restart).

Permission issues¶

sudo chown -R lucedev:lucedev /var/lib/lucedev-syslog /var/log/lucedev-syslog
sudo chmod 750 /var/lib/lucedev-syslog /var/log/lucedev-syslog

Corrupt settings.json¶

If settings.json has invalid JSON or an out-of-range value, the service may crash on startup. Check the application logs:

sudo journalctl -u lucedev-syslog -n 50

To reset to defaults, delete settings.json and restart — the server creates a fresh one with defaults on next launch.

net stop LuceDevSyslog
Remove-Item "C:\Program Files\LuceDev Syslog\settings.json"
net start LuceDevSyslog

sudo systemctl stop lucedev-syslog
sudo rm /var/lib/lucedev-syslog/settings.json
sudo systemctl start lucedev-syslog

Dashboard won't load¶

Symptom: Browser shows connection refused or times out at http://<server-ip>:5000.

Not receiving syslog messages¶

Symptom: Dashboard loads but no logs arrive.

1. Confirm the listener — the green status dot in the top-right of the dashboard shows the active listener and port.
2. Verify the source — check device-side configuration. Many devices need a syslog facility set in addition to the destination.

3. Test locally:

   WindowsLinux

   $udp = New-Object System.Net.Sockets.UdpClient
   $bytes = [Text.Encoding]::ASCII.GetBytes("<14>Test message")
   $udp.Send($bytes, $bytes.Length, "127.0.0.1", 514)
   $udp.Close()
   

   logger -n 127.0.0.1 -P 514 "Test syslog message"
   

4. Check both firewalls — host firewall and any network firewall between source and server.

5. Check the bind address — if syslog_host is set to 127.0.0.1, only local traffic is received. Use 0.0.0.0 to listen on all interfaces.
6. License state — when unlicensed, the syslog receiver silently drops incoming messages. Check Settings → License for the current state.

Slow dashboard¶

Symptom: Pages take seconds to load, especially when scrolling deep.

1. Use an SSD. Spinning disks are the #1 cause of slow SQLite queries on large databases.
2. Reduce retention. A smaller database scans faster. Drop from 90 to 30 days if you don't need the history.
3. Run VACUUM from Settings → Database → Maintenance after large archival or retention changes. SQLite holds onto deleted pages until VACUUM reclaims them.
4. Rebuild the stats cache if dashboard counters look wrong — Settings → Database → Maintenance.
5. Check available disk space — SQLite degrades badly when the volume is nearly full.

Service restart from the dashboard doesn't work¶

sudo systemctl restart lucedev-syslog
sudo systemctl status lucedev-syslog

SmartScreen warning on Windows install¶

Symptom: Windows shows "Windows protected your PC" when running the installer.

This is because the installer is new and hasn't built download reputation yet. Click More info → Run anyway to proceed.

Email notifications not sending¶

1. Send a test email from Settings → Email (SMTP) — the inline error tells you exactly which step failed.
2. Check the application logs for SMTP error lines (search for smtplib or Failed to send notification).
3. Confirm your SMTP relay accepts connections from the syslog server's IP. Many providers restrict by source.
4. Confirm the From address is allowed to send from your relay (Gmail and Microsoft 365 reject mismatched From addresses).
5. Check Settings → Notifications:
   • Severity alerts on? Severity levels selected?
   • Recipients filled in?
   • Cooldown not so long that you're suppressing your own test?

License says "Server unreachable" but my internet works¶

The server hits https://lucedev.com/api/validate. If your network blocks outbound HTTPS to lucedev.com:

• Confirm the syslog VM has outbound 443 to lucedev.com
• If you run a corporate proxy, the proxy CA cert must be trusted by the Python runtime
• The server enters grace state and stays usable for 7 more days while you resolve the network path

Where to find the application logs¶

C:\Program Files\LuceDev Syslog\logs\lucedev.log

sudo journalctl -u lucedev-syslog -f

/var/log/lucedev-syslog/lucedev.log

Application logs are also written by the WinSW wrapper on Windows (rolling at 10 MB, 3 files kept).