Syslog not forward from XG135 to Graylog

Hi Laxmi Diamond:  You may validate the Syslog configuration as per the below help section:

https://docs.sophos.com/nsg/sophos-firewall/18.0/Help/en-us/webhelp/onlinehelp/AdministratorHelp/SystemServices/LogSettings/SyslogServerAdd/index.html

If Configuration seems to be fine then you may take SSH of XG and navigate to Console option and use tcpdump to capture the packets on Syslog server IP.

community.sophos.com/.../sophos-xg-firewall-how-to-tcpdump

Based on packet request if the request is going out via the correct interface to Syslog server then it indicates XG is already forwarding logs data to Syslog server.

Hi Vishal,

Thank you for sharing information,

Our problem resolved with "Port number for communication with the syslog server" means graylog syslog collecting from port no. 5001.

System services => Log settings => Syslog servers

So, we have set port 5001 instead of 514 in firewall syslog servers log settings.

Thanak you. 

Hi Vishal,

Thank you for sharing information,

Our problem resolved with "Port number for communication with the syslog server" means graylog syslog collecting from port no. 5001.

System services => Log settings => Syslog servers

So, we have set port 5001 instead of 514 in firewall syslog servers log settings.

Thanak you.