<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Hello Benjamin,</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="font-family: Arial, Helvetica, sans-serif; background-color: rgb(255, 255, 255); display: inline !important"> since your network card receives the traffic, but nothing else on your system. I think we can narrow it to a routing problem.</span><br>
</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="color: rgb(0, 0, 0); font-family: Arial, Helvetica, sans-serif; font-size: 12pt;"> you might have missed Janos's previous email: </span><a href="https://lists.balabit.hu/pipermail/syslog-ng/2020-August/026038.html" style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt;">https://lists.balabit.hu/pipermail/syslog-ng/2020-August/026038.html</a> You
might want to try it.<br>
</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Without knowing your system, I can only make blind guesses. I would rather not direct you into the wrong direction.</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Best regards,</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Laci</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> syslog-ng <syslog-ng-bounces@lists.balabit.hu> on behalf of Bruns, Benjamin <Benjamin.Bruns@cypp.de><br>
<b>Sent:</b> Monday, August 31, 2020 16:26<br>
<b>To:</b> Syslog-ng users' and developers' mailing list <syslog-ng@lists.balabit.hu><br>
<b>Subject:</b> Re: [syslog-ng] syslog-ng is ignoring a network source</font>
<div> </div>
</div>
<style>
<!--
@font-face
{font-family:"Cambria Math"}
@font-face
{font-family:Calibri}
p.x_MsoNormal, li.x_MsoNormal, div.x_MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif}
a:link, span.x_MsoHyperlink
{color:#0563C1;
text-decoration:underline}
a:visited, span.x_MsoHyperlinkFollowed
{color:#954F72;
text-decoration:underline}
p.x_msonormal0, li.x_msonormal0, div.x_msonormal0
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif}
p.x_xmsonormal, li.x_xmsonormal, div.x_xmsonormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif}
p.x_xmsonormal0, li.x_xmsonormal0, div.x_xmsonormal0
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif}
p.x_xxmsonormal, li.x_xxmsonormal, div.x_xxmsonormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif}
p.x_xxmsochpdefault, li.x_xxmsochpdefault, div.x_xxmsochpdefault
{margin-right:0cm;
margin-left:0cm;
font-size:11.0pt;
font-family:"Calibri",sans-serif}
p.x_xmsochpdefault, li.x_xmsochpdefault, div.x_xmsochpdefault
{margin-right:0cm;
margin-left:0cm;
font-size:10.0pt;
font-family:"Calibri",sans-serif}
span.x_xmsohyperlink
{color:#0563C1;
text-decoration:underline}
span.x_xmsohyperlinkfollowed
{color:#954F72;
text-decoration:underline}
span.x_xxmsohyperlink
{color:#0563C1;
text-decoration:underline}
span.x_xxmsohyperlinkfollowed
{color:#954F72;
text-decoration:underline}
span.x_xxe-mailformatvorlage17
{font-family:"Calibri",sans-serif;
color:windowtext}
span.x_xe-mailformatvorlage25
{font-family:"Calibri",sans-serif;
color:windowtext}
span.x_E-MailFormatvorlage31
{font-family:"Calibri",sans-serif;
color:windowtext}
.x_MsoChpDefault
{font-size:10.0pt}
@page WordSection1
{margin:70.85pt 70.85pt 2.0cm 70.85pt}
div.x_WordSection1
{}
-->
</style>
<div lang="DE" link="#0563C1" vlink="#954F72">
<div style="background-color:#FFEB9C; width:100%; border-style:solid; border-color:#9C6500; border-width:1pt; padding:2pt; font-size:10pt; line-height:12pt; font-family:'Calibri'; color:Black; text-align:left">
<span style="color:#9C6500; font-weight:bold">CAUTION:</span> This email originated from outside of the organization. Do not follow guidance, click links, or open attachments unless you recognize the sender and know the content is safe.</div>
<br>
<div>
<div class="x_WordSection1">
<p class="x_MsoNormal"><span style="">Hello Laci,</span></p>
<p class="x_MsoNormal"><span style=""> </span></p>
<p class="x_MsoNormal"><span lang="EN-US" style="">Question: I can successfully read the logs of the firewall that is located in the same network that my logserver is, but the second firewall is sending the logs from a different network segment to the log server.
Does this causes the problem? Again: I can see the traffic on my network interface, but netcat doesn’t receive anything on port 514 (for the second firewall). Does iptables fools me somehow?</span></p>
<p class="x_MsoNormal"><span lang="EN-US" style=""> </span></p>
<div>
<p class="x_MsoNormal"><span style="font-size:10.0pt; font-family:"Arial",sans-serif">Mit freundlichen Grüßen / Best regards</span><span style="font-size:10.0pt; font-family:"Arial",sans-serif"></span></p>
<p class="x_MsoNormal"><span style="font-size:10.0pt; font-family:"Arial",sans-serif"> </span></p>
<p class="x_MsoNormal"><span style="font-size:10.0pt; font-family:"Arial",sans-serif">Benjamin Bruns</span></p>
<p class="x_MsoNormal"><span lang="EN-US" style="font-size:10.0pt; font-family:"Arial",sans-serif">IT Security Manager</span><span lang="EN-US" style="font-family:"Arial",sans-serif"> </span></p>
<p class="x_MsoNormal"><span lang="EN-US" style="font-size:10.0pt; font-family:"Arial",sans-serif"> </span></p>
<p class="x_MsoNormal"><span lang="EN-US" style="font-size:10.0pt; font-family:"Arial",sans-serif">CYPP GmbH</span></p>
<p class="x_MsoNormal"><span lang="EN-US" style="font-size:10.0pt; font-family:"Arial",sans-serif">Gotenstrasse 15</span></p>
<p class="x_MsoNormal"><span style="font-size:10.0pt; font-family:"Arial",sans-serif">20097 Hamburg</span></p>
<p class="x_MsoNormal"><span style="font-size:10.0pt; font-family:"Arial",sans-serif">Germany</span></p>
<p class="x_MsoNormal"><span style="font-size:10.0pt; font-family:"Arial",sans-serif"> </span></p>
<p class="x_MsoNormal"><span style="font-size:10.0pt; font-family:"Arial",sans-serif">Telefon: +49 40 237 34-285</span></p>
<p class="x_MsoNormal"><span style="font-size:10.0pt; font-family:"Arial",sans-serif">Mobil: +49 160 3230 655</span></p>
<p class="x_MsoNormal"><span style="font-size:10.0pt; font-family:"Arial",sans-serif">Mail:<b>
<a href="mailto:benjamin.bruns@cypp.de">benjamin.bruns@cypp.de</a></b></span></p>
<p class="x_MsoNormal"><b><span style="font-size:10.0pt; font-family:"Arial",sans-serif"> </span></b></p>
<p class="x_MsoNormal"><b><span style="font-size:10.0pt; font-family:"Arial",sans-serif"><a href="https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.cypp.de%2F&data=02%7C01%7CLaszlo.Szemere%40oneidentity.com%7C22955db2b31d4b0f063c08d84db9e001%7C91c369b51c9e439c989c1867ec606603%7C0%7C1%7C637344808024846543&sdata=Mt3t%2Fm9%2BrmF%2BtYRkXKq73dciNLwjE6x2wyzxNHQqOW0%3D&reserved=0" originalsrc="http://www.cypp.de/" shash="ZBqyHcC9agHD/l8MxOyf09xcrnpALqmfLZxodAZlr5z/DyC7ved9IJvsA1Im+WQpKW/fHKDIAMIpuVXgP4LVdxdk8IBqMfyd0Gksln+oXdnH1FrSbwOb8tLWg+sakdWHQYQuPmqvfkjb7w3tk0C3aTQJUuWtFKATPYaTY9vxA+c=">www.cypp.de</a>
| <a href="https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.plathgroup.com%2F&data=02%7C01%7CLaszlo.Szemere%40oneidentity.com%7C22955db2b31d4b0f063c08d84db9e001%7C91c369b51c9e439c989c1867ec606603%7C0%7C1%7C637344808024846543&sdata=goF7jjDYoCubuAsqPOeSEETWPGVgHaNWItE9IiCntH4%3D&reserved=0" originalsrc="http://www.plathgroup.com/" shash="QIBixNqeTu3TpxkK6cucd40UJMhDouuz4Fzf95nRL9Tr29LyTIfgXcR8HkMcsrMoDDuS4gqTpuFY4r/fE9/Fjuo+PlyH3VMKgOQfACyJcg2vqOMrrYvgtoKS/w4Lotq1ekONO+kw7reXjBU5DmQhBM8CIUhpuNIlfqS0IjBxs9M=">
www.plathgroup.com</a></span></b><span style="font-size:10.0pt; font-family:"Arial",sans-serif"></span></p>
<p class="x_MsoNormal"><span style="font-size:10.0pt; font-family:"Arial",sans-serif"> </span></p>
<p class="x_MsoNormal"><span style="font-size:10.0pt; font-family:"Arial",sans-serif">Sitz der Gesellschaft: Hamburg</span></p>
<p class="x_MsoNormal"><span style="font-size:10.0pt; font-family:"Arial",sans-serif">HRB 132781 Amtsgericht Hamburg</span></p>
<p class="x_MsoNormal"><span style="font-size:10.0pt; font-family:"Arial",sans-serif">Ust-ID DE 298033875</span></p>
<p class="x_MsoNormal"><span style="font-size:10.0pt; font-family:"Arial",sans-serif">Vertretungsberechtigter Geschäftsführerin: Maya von Holdt</span></p>
<p class="x_MsoNormal"><span style="font-size:10.0pt; font-family:"Arial",sans-serif"> </span></p>
<p class="x_MsoNormal"><span style="font-size:10.0pt; font-family:"Arial",sans-serif">Dies ist eine vertrauliche Nachricht und nur für den Adressaten bestimmt. Es ist nicht erlaubt, diese Nachricht zu kopieren oder Dritten zugänglich zu machen. Sollten Sie
diese Nachricht irrtümlich erhalten haben, benachrichtigen Sie den Versender bitte per E-Mail oder telefonisch und löschen Sie die Nachricht unverzüglich.</span></p>
<p class="x_MsoNormal"><span style="font-size:10.0pt; font-family:"Arial",sans-serif"> </span></p>
<p class="x_MsoNormal"><span lang="EN-US" style="font-size:10.0pt; font-family:"Arial",sans-serif">This message is strictly confidential and intended solely for the use of the addressee. It is not allowed to copy or disseminate this message. Please notify the
sender by e-mail or telephone if you have received this message by mistake and delete this message immediately.</span><span lang="EN-US"></span></p>
</div>
<p class="x_MsoNormal"><span lang="EN-US" style=""> </span></p>
<div>
<div style="border:none; border-top:solid #E1E1E1 1.0pt; padding:3.0pt 0cm 0cm 0cm">
<p class="x_MsoNormal"><b>Von:</b> syslog-ng <syslog-ng-bounces@lists.balabit.hu>
<b>Im Auftrag von </b>Laszlo Szemere (lszemere)<br>
<b>Gesendet:</b> Freitag, 28. August 2020 13:41<br>
<b>An:</b> Syslog-ng users' and developers' mailing list <syslog-ng@lists.balabit.hu><br>
<b>Betreff:</b> Re: [syslog-ng] syslog-ng is ignoring a network source</p>
</div>
</div>
<p class="x_MsoNormal"> </p>
<div>
<p class="x_MsoNormal"><span style="font-size:12.0pt; font-family:"Arial",sans-serif; color:black">Hello Ben,</span></p>
</div>
<div>
<p class="x_MsoNormal"><span style="font-size:12.0pt; font-family:"Arial",sans-serif; color:black"> </span></p>
</div>
<div>
<p class="x_MsoNormal"><span style="font-size:12.0pt; font-family:"Arial",sans-serif; color:black"> nc -u -l -p 514</span></p>
</div>
<div>
<p class="x_MsoNormal"><span style="font-size:12.0pt; font-family:"Arial",sans-serif; color:black"> </span></p>
</div>
<div>
<p class="x_MsoNormal"><span style="font-size:12.0pt; font-family:"Arial",sans-serif; color:black"> -u : use UDP</span></p>
</div>
<div>
<p class="x_MsoNormal"><span style="font-size:12.0pt; font-family:"Arial",sans-serif; color:black"> -l : listen in server mode, instead of sending</span></p>
</div>
<div>
<p class="x_MsoNormal"><span style="font-size:12.0pt; font-family:"Arial",sans-serif; color:black"> -p : defines port number</span></p>
</div>
<div>
<p class="x_MsoNormal"><span style="font-size:12.0pt; font-family:"Arial",sans-serif; color:black"> </span></p>
</div>
<div>
<p class="x_MsoNormal"><span style="font-size:12.0pt; font-family:"Arial",sans-serif; color:black">(If you need, you can also specify the local IP address to bind to with the -s option.)</span></p>
</div>
<div>
<p class="x_MsoNormal"><span style="font-size:12.0pt; font-family:"Arial",sans-serif; color:black"> </span></p>
</div>
<div>
<p class="x_MsoNormal"><span style="font-size:12.0pt; font-family:"Arial",sans-serif; color:black"> </span></p>
</div>
<div>
<p class="x_MsoNormal"><span style="font-size:12.0pt; font-family:"Arial",sans-serif; color:black">Br,</span></p>
</div>
<div>
<p class="x_MsoNormal"><span style="font-size:12.0pt; font-family:"Arial",sans-serif; color:black">Laci</span></p>
</div>
<div>
<p class="x_MsoNormal"><span style="font-size:12.0pt; font-family:"Arial",sans-serif; color:black"> </span></p>
</div>
<div class="x_MsoNormal" align="center" style="text-align:center">
<hr size="2" width="98%" align="center">
</div>
<div id="x_divRplyFwdMsg">
<p class="x_MsoNormal"><b><span style="color:black">From:</span></b><span style="color:black"> syslog-ng <<a href="mailto:syslog-ng-bounces@lists.balabit.hu">syslog-ng-bounces@lists.balabit.hu</a>> on behalf of Bruns, Benjamin <<a href="mailto:Benjamin.Bruns@cypp.de">Benjamin.Bruns@cypp.de</a>><br>
<b>Sent:</b> Friday, August 28, 2020 13:29<br>
<b>To:</b> Syslog-ng users' and developers' mailing list <<a href="mailto:syslog-ng@lists.balabit.hu">syslog-ng@lists.balabit.hu</a>><br>
<b>Subject:</b> Re: [syslog-ng] syslog-ng is ignoring a network source</span> </p>
<div>
<p class="x_MsoNormal"> </p>
</div>
</div>
<div>
<div style="border:solid #9C6500 1.0pt; padding:2.0pt 2.0pt 2.0pt 2.0pt">
<p class="x_MsoNormal" style="line-height:12.0pt; background:#FFEB9C"><b><span style="font-size:10.0pt; color:#9C6500">CAUTION:</span></b><span style="font-size:10.0pt; color:black"> This email originated from outside of the organization. Do not follow guidance,
click links, or open attachments unless you recognize the sender and know the content is safe.</span></p>
</div>
<p class="x_MsoNormal"> </p>
<div>
<div>
<p class="x_xmsonormal">Hello Laci,</p>
<p class="x_xmsonormal"> </p>
<p class="x_xmsonormal"><span lang="EN-US">how do I check that by using netcat?</span></p>
<p class="x_xmsonormal"><span lang="EN-US"> </span></p>
<p class="x_xmsonormal"><span lang="EN-US">Cheers, Ben</span></p>
<p class="x_xmsonormal"><span lang="EN-US"> </span></p>
<div>
<div style="border:none; border-top:solid #E1E1E1 1.0pt; padding:3.0pt 0cm 0cm 0cm">
<p class="x_xmsonormal"><b>Von:</b> syslog-ng <<a href="mailto:syslog-ng-bounces@lists.balabit.hu">syslog-ng-bounces@lists.balabit.hu</a>>
<b>Im Auftrag von </b>Laszlo Szemere (lszemere)<br>
<b>Gesendet:</b> Freitag, 28. August 2020 12:21<br>
<b>An:</b> Syslog-ng users' and developers' mailing list <<a href="mailto:syslog-ng@lists.balabit.hu">syslog-ng@lists.balabit.hu</a>><br>
<b>Betreff:</b> Re: [syslog-ng] syslog-ng is ignoring a network source</p>
</div>
</div>
<p class="x_xmsonormal"> </p>
<div>
<p class="x_xmsonormal"><span style="font-size:12.0pt; font-family:"Arial",sans-serif; color:black">Hello Ben,</span></p>
</div>
<div>
<p class="x_xmsonormal"><span style="font-size:12.0pt; font-family:"Arial",sans-serif; color:black"> </span></p>
</div>
<div>
<p class="x_xmsonormal"><span style="font-size:12.0pt; font-family:"Arial",sans-serif; color:black"> our experience shows that having logs in Wireshark doesn't necessary means that they reach the applications. (Wireshark captures packets on the interface level.)</span></p>
</div>
<div>
<p class="x_xmsonormal"><span style="font-size:12.0pt; font-family:"Arial",sans-serif; color:black"> So as a first step I would recommend to clarify that the logs from the second host indeed reaches Syslog-ng. (For UDP logs netcat usually is enough.)</span></p>
</div>
<div>
<p class="x_xmsonormal"><span style="font-size:12.0pt; font-family:"Arial",sans-serif; color:black"> </span></p>
</div>
<div>
<p class="x_xmsonormal"><span style="font-size:12.0pt; font-family:"Arial",sans-serif; color:black"> Once it is clear that those logs reaches the application level, we can focus on debugging Syslog-ng.</span></p>
</div>
<div>
<p class="x_xmsonormal"><span style="font-size:12.0pt; font-family:"Arial",sans-serif; color:black"> </span></p>
</div>
<div>
<p class="x_xmsonormal"><span style="font-size:12.0pt; font-family:"Arial",sans-serif; color:black"> By starting Syslog-ng with the following options, it would be much easier to examine the flow of messages:</span></p>
</div>
<div>
<p class="x_xmsonormal"><span style="font-size:12.0pt; font-family:"Arial",sans-serif; color:black"> syslog-ng -Fdevt</span></p>
</div>
<div>
<p class="x_xmsonormal"><span style="font-size:12.0pt; font-family:"Arial",sans-serif; color:black"> </span></p>
</div>
<div>
<p class="x_xmsonormal"><span style="font-size:12.0pt; font-family:"Arial",sans-serif; color:black"> -F : start it in the foreground</span></p>
</div>
<div>
<p class="x_xmsonormal"><span style="font-size:12.0pt; font-family:"Arial",sans-serif; color:black"> -d : debug mode</span></p>
</div>
<div>
<p class="x_xmsonormal"><span style="font-size:12.0pt; font-family:"Arial",sans-serif; color:black"> -e : log messages to stderr</span></p>
</div>
<div>
<p class="x_xmsonormal"><span style="font-size:12.0pt; font-family:"Arial",sans-serif; color:black"> -v : increases verbository</span></p>
</div>
<div>
<p class="x_xmsonormal"><span style="font-size:12.0pt; font-family:"Arial",sans-serif; color:black"> -t : also enable trace messages</span></p>
</div>
<div>
<p class="x_xmsonormal"><span style="font-size:12.0pt; font-family:"Arial",sans-serif; color:black"> </span></p>
</div>
<div>
<p class="x_xmsonormal"><span style="font-size:12.0pt; font-family:"Arial",sans-serif; color:black">Note: With these options enabled, Syslog-ng will produce a LOT of messages. So if you can turn off other logging sources temporary, than it will be much more
easier to read those logs.</span></p>
</div>
<div>
<p class="x_xmsonormal"><span style="font-size:12.0pt; font-family:"Arial",sans-serif; color:black"> </span></p>
</div>
<div>
<p class="x_xmsonormal"><span style="font-size:12.0pt; font-family:"Arial",sans-serif; color:black">At this point you should start to receive this kind of debug messages, which will indicate that Syslog-ng received the log messages from your host:</span></p>
</div>
<div>
<p class="x_xmsonormal"><span style="font-size:12.0pt; font-family:"Arial",sans-serif; color:black"> </span></p>
</div>
<div>
<p class="x_xmsonormal"><span style="font-size:12.0pt; font-family:"Arial",sans-serif; color:black"> [2020-08-28T10:09:43.289660] Incoming log entry; line='hello world'</span></p>
</div>
<div>
<p class="x_xmsonormal"><span style="font-size:12.0pt; font-family:"Arial",sans-serif; color:black"> </span></p>
</div>
<div>
<p class="x_xmsonormal"><span style="font-size:12.0pt; font-family:"Arial",sans-serif; color:black">From this point the easiest way is to start with a minimal config, and build up your final configuration step by step. Checking incoming logs in each steps.</span></p>
</div>
<div>
<p class="x_xmsonormal"><span style="font-size:12.0pt; font-family:"Arial",sans-serif; color:black"> </span></p>
</div>
<div>
<p class="x_xmsonormal"><span style="font-size:12.0pt; font-family:"Arial",sans-serif; color:black"> </span></p>
</div>
<div>
<p class="x_xmsonormal"><span style="font-size:12.0pt; font-family:"Arial",sans-serif; color:black">Br,</span></p>
</div>
<div>
<p class="x_xmsonormal"><span style="font-size:12.0pt; font-family:"Arial",sans-serif; color:black">Laci</span></p>
</div>
<div>
<p class="x_xmsonormal"><span style="font-size:12.0pt; font-family:"Arial",sans-serif; color:black"> </span></p>
</div>
<div>
<p class="x_xmsonormal"><span style="font-size:12.0pt; font-family:"Arial",sans-serif; color:black"> </span></p>
</div>
<div class="x_MsoNormal" align="center" style="text-align:center">
<hr size="2" width="98%" align="center">
</div>
<div id="x_x_divRplyFwdMsg">
<p class="x_xmsonormal"><b><span style="color:black">From:</span></b><span style="color:black"> syslog-ng <<a href="mailto:syslog-ng-bounces@lists.balabit.hu">syslog-ng-bounces@lists.balabit.hu</a>> on behalf of Bruns, Benjamin <<a href="mailto:Benjamin.Bruns@cypp.de">Benjamin.Bruns@cypp.de</a>><br>
<b>Sent:</b> Friday, August 28, 2020 11:53<br>
<b>To:</b> <a href="mailto:syslog-ng@lists.balabit.hu">syslog-ng@lists.balabit.hu</a> <<a href="mailto:syslog-ng@lists.balabit.hu">syslog-ng@lists.balabit.hu</a>><br>
<b>Subject:</b> [syslog-ng] syslog-ng is ignoring a network source</span> </p>
<div>
<p class="x_xmsonormal"> </p>
</div>
</div>
<div>
<div style="border:solid #9C6500 1.0pt; padding:2.0pt 2.0pt 2.0pt 2.0pt">
<p class="x_xmsonormal" style="line-height:12.0pt; background:#FFEB9C"><b><span style="font-size:10.0pt; color:#9C6500">CAUTION:</span></b><span style="font-size:10.0pt; color:black"> This email originated from outside of the organization. Do not follow guidance,
click links, or open attachments unless you recognize the sender and know the content is safe.</span></p>
</div>
<p class="x_xmsonormal"> </p>
<div>
<div>
<p class="x_xxmsonormal">Hello!</p>
<p class="x_xxmsonormal"> </p>
<p class="x_xxmsonormal"><span lang="EN-US">I try to send syslogs from two firewalls to my syslog-ng host. The first one worked immediately, but logs of the second firewall seems to be ignored. Both syslogs come in via UDP on port 514 and I can see them in
Wireshark on my syslog-ng host, but they disappear for my second firewall in a black hole. Both have Logstash as their destination configured. Any ideas? Thanks in advance!</span></p>
<p class="x_xxmsonormal"><span lang="EN-US"> </span></p>
<p class="x_xxmsonormal"><span lang="EN-US">Cheers, Ben</span></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</body>
</html>