Re: SIEM cannot received log when SRX using stream mode?

Hi kronicklez,

Looks like the SRX is sending the logs as the transmitted bytes are there on the SPUs :-

0:  name=TO-SIEM, ip(H)=a446747 (a 44 67 47), port=514, codec=2, sev=7
     ip_id=233, tx=233, txByte=138936, txFail=0, dropByte=0
     sevDropCnt=0
     fwd egress=0, fwd ingress=0.

This looks to be a problem on the SIEM as the SRX is sending the logs.

You can take packet captures on the SIEM to verify if it is receiving the logs from the SRX.

Regards,

Sahil Sharma
---------------------------------------------------
Please mark my solution as accepted if it helped, Kudos are appreciated as well.