> For the complete documentation index, see [llms.txt](https://docs.enginsight.com/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.enginsight.com/docs/knowledge-base/english/troubleshooting/no-logs-are-arriving-at-my-enginsight-event-relay-what-can-i-do.md).

# No logs are arriving at my Enginsight event relay. What can I do?

Setting up an [event relay](https://docs.enginsight.com/docs/manual/english/platform-usage/siem/general-collectors/event-relays) allows you to use the Enginsight agent Pulsar as a syslog relay. It receives syslog data from sources on which no Pulsar can be installed (such as Fortigate, Cisco, or Sophos firewalls, or generic Syslog senders), processes the data, and forwards it to the Enginsight SIEM.

If logs do not arrive from a source at an event relay and therefore do not appear in the [data lake](https://docs.enginsight.com/docs/manual/english/platform-usage/siem/data-lake), the cause is often a mismatch between the syslog format used by the source (sender) and the event relay (receiver).

***

Follow these steps to check whether the configured syslog formats match.

{% stepper %}
{% step %}

### Confirm that Pulsar is listening on the correct port

Use the following commands to confirm that Pulsar is listening on the correct port:

* **For UDP**:

```
ss -uapn | grep :5140
```

For example, the expected output looks like this:

```
UNCONN 0 0 0.0.0.0:5140 0.0.0.0:* users:(("ngs-pulsar",pid=1552167,fd=9))
```

* **For TCP**:

```
ss -tapn | grep :5140
```

If there is no output, the problem is not related to the syslog format but to the collector configuration.
{% endstep %}

{% step %}

### Capture sent packets with `tcpdump`

Capture the sent packets using the following command:

* **For UDP**:

```
sudo tcpdump -ni <Interface> port 5140 -A
```

{% hint style="info" %}
Remember to replace `<Interface>` with the corresponding network interface, for example `enp1s0`, `eth0`, or `any`.
{% endhint %}

* **For TCP**:

```
sudo tcpdump -ni <Interface> tcp port 5140 -A
```

{% hint style="info" %}
You can optionally add the parameter `-c 20` to the commands. This limits `tcpdump` to 20 packets and then stops it automatically.
{% endhint %}
{% endstep %}

{% step %}

### Identify the syslog format in use

A typical captured payload looks like this:

```
15:16:30.208451 IP 10.10.10.100.25000 > 10.10.42.254.5140: UDP, length 657
E....+..?..w<189>date=2026-05-27 time=15:16:30 devname="GATE01" ...
```

{% hint style="info" %}
You can ignore the header bytes (`E....+..?..w`). These are IP/UDP headers shown in ASCII representation. The relevant payload starts with the `<` character.
{% endhint %}

#### RFC 3164 (BSD) or RFC 5424

The syslog standards **RFC 3164 (BSD)** and **RFC 5424** both start with the priority field `<PRI>` in angle brackets. In the example above, this is `<189>`.

After that, the syslog standards differ as follows:

* **RFC 3164 (BSD)**: A plain-text date, a month name, or a key-value pair follows directly, for example `<189>date=2026-05-27 time=15:16:30 devname="GATE01"`
* **RFC 5424**: A `1` follows first, which is the version number of the standard, followed by a space and an ISO 8601 timestamp, for example `<189>1 2026-05-27T15:16:30.000Z`

#### RFC 6587

If the logs are sent via TCP and the packet starts with a number followed by a space (`657 <189>...`), **octet-counting framing** according to **RFC 6587** is being used.

The number specifies the length of the following message. This is not a separate content standard, but a transport wrapper around RFC 3164 or RFC 5424. However, it should also match the event relay settings in Enginsight.
{% endstep %}

{% step %}

### Compare the format with the event relay configuration in Enginsight

1. In the Enginsight platform, navigate to **SIEM** → **General Collectors** → [Event Relays](https://docs.enginsight.com/docs/manual/english/platform-usage/siem/general-collectors/event-relays) and click the affected event relay to edit it.
2. Check which syslog format is selected in the **Format** field and whether it matches the [sender format you identified previously](#identify-the-syslog-format-in-use).
3. If the formats do not match, change the format accordingly.
4. Click **Save Changes**.
5. Wait 5 to 10 minutes and check whether the expected logs now appear under **SIEM** → [Data Lake](https://docs.enginsight.com/docs/manual/english/platform-usage/siem/data-lake).
   {% endstep %}
   {% endstepper %}

***

## Additional notes

**CEF is no syslog format**

* If the sender is switched to CEF (Common Event Format), this changes the payload content but not the syslog format. The syslog format usually remains RFC 3164. For this case, you must also configure a suitable [extractor](https://docs.enginsight.com/docs/manual/english/platform-usage/siem/advanced-settings/extractors) in Enginsight.

**Using TLS over port 6514**

* When using TLS over port 6514, the `tcpdump -A` command is not useful because the payload is encrypted. In this case, check the syslog format directly on the sender.

***