Rather than solely relying on Thwack, I recommend opening a Support Ticket with Solarwinds Support, placing the appropriate level of priority. Typically SW Support gets to cases without "site down" status within two or three days, and often resolves the issue within two weeks.
I've been running Kiwi Syslog for a long time, but have not seen this particular problem, hence my suggestion to contact Support. Information that might be useful to include pertains to the source of the syslog messages:
- Do the correctly-formatted messages come from the same host that partakes in the incorrectly-formatted messages?
- If so, you may have a Kiwi bug
- If not, verify the sending conditions from each of the servers are identical. Each one should be fully resolvable in DNS, use the same kinds of credentials and authentications, and use identical formats for sending to Kiwi.
- Do all of the messages (properly formatted and improperly formatted) trigger the same Kiwi Syslog rule?
- Do they all use the same parameters for source & destination?
I think your task is to identify what's different or unique about the improperly formatted messages. The devices and conditions that trigger them, DNS resolution, authentication, etc. Once you've found what different about the conditions that cause the problem messages, you may be able to correct the issue. Could it be something within you mail server solution, or something unusual about the syslog message coming to Kiwi?
Do you include servers and Kiwi and DNS and security in your Change Management Solution? If so, and if you can identify the date this problem began, you may be able to correlate scheduled changes with the date of the first occurrence of the problem. Then you may have a path to follow through Change Management to discover the smoking gun.