Am working on closing out a small project and have run into issues with a small number of linux servers.

The servers are configured to forward to an event collector on tcp port 6514, and while the traffic can be observed when running tcpdump on the EC - nothing populates in the SIEM and no log sources are generated.

This is difficult to understand as many other hosts (linux) are successfully forwarding from the same subnet and generating log sources without issue. 

Any guidance or direction is greatly appreciated.

------------------------------
JG
------------------------------

From the console's UI take a look the EC's event log. These are prefixed by the following name

SIM Generic Log DSM

You will have one for each collector, and example name is

SIM Generic Log DSM-111 :: QRACollector1

111 being the collector ID and QRACollector1 is the hostname of the collector. 

Arrange this log source by source IP and compare to the IP addresses of the systems you are missing. If you have information in this location then you would have to create a manual log source and pay attention to the Log Source Identifier and ensure it matches the IP of hostname of sources shown in the above event log.


Good luck!

------------------------------
JH
------------------------------