# Syslog/UDP input plugin : No message receive from Dell Blade switch

**URL:** <https://discuss.elastic.co/t/syslog-udp-input-plugin-no-message-receive-from-dell-blade-switch/113190>\
**Category:** Logstash\
**Created:** [December 26, 2017, 9:34am UTC](https://discuss.elastic.co/t/syslog-udp-input-plugin-no-message-receive-from-dell-blade-switch/113190 "2017-12-26T09:34:24Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![gugansankar](https://avatars.discourse-cdn.com/v4/letter/g/e274bd/32.png) [@gugansankar](https://discuss.elastic.co/u/gugansankar)\
**Post date:** [December 26, 2017, 9:34am UTC](https://discuss.elastic.co/t/syslog-udp-input-plugin-no-message-receive-from-dell-blade-switch/113190/1 "2017-12-26T09:34:24Z")

</div>

I'm replacing existing syslog with ELK setup.

I tried to send some devices syslog message, all messages are received by logstash [syslog Plugiin] without any issue. EXCEPT "dell Blade switch". I don't know why.

To ensure the packet atleast reaches the syslog server that sent by Switch , I run "tcpdump". below is log

```
13:46:42.557571 IP (tos 0x0, ttl 62, id 63117, offset 0, flags [none], proto UDP (17), length 160)
    10.10.10.14.61564 > 10.11.12.169.514: SYSLOG, length: 132
	Facility local7 (23), Severity notice (5)
	Msg: Dec 26 08:17:02: TG-TES-ED-QWS-R1: %MXL-10/40GbE:0 %OFAGT-5-OFA_AGT_LOG: OFA: Registeration with OFM not completed, retrying...
	0x0000: 4500 00a0 f68d 0000 3e11 01f5 0a15 6302 E.......>.....c.
	0x0010: 0a0b 0ca9 f07c 0202 008c 41d7 3c31 3839 .....|....A.<189
	0x0020: 3e44 6563 2032 3620 3038 3a31 373a 3032 >Dec.26.08:17:02
	0x0030: 3a20 5047 2d4c 4153 2d44 432d 4d58 4c2d :.TG-TES-ED-QWS-
	0x0040: 5231 3a20 254d 584c 2d31 302f 3430 4762 R1:.%MXL-10/40Gb
	0x0050: 453a 3020 254f 4641 4754 2d35 2d4f 4641 E:0.%OFAGT-5-OFA
	0x0060: 5f41 4754 5f4c 4f47 3a20 4f46 413a 2052 _AGT_LOG:.OFA:.R
	0x0070: 6567 6973 7465 7261 7469 6f6e 2077 6974 egisteration.wit
	0x0080: 6820 4f46 4d20 6e6f 7420 636f 6d70 6c65 h.OFM.not.comple
	0x0090: 7465 642c 2072 6574 7279 696e 672e 2e2e ted,.retrying...

```

It completely shows, the packet reaches the logstash "syslog" input filter port. But I don't know why it was not logged in the file.

For testing, I send message from Cisco Switch/Router to the same syslog input filter , It logged successfully.

I've only doubt, why the log messages is unable to receive by logstash input plugin [EVEN tested UDP] also.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [December 31, 2017, 1:29pm UTC](https://discuss.elastic.co/t/syslog-udp-input-plugin-no-message-receive-from-dell-blade-switch/113190/2 "2017-12-31T13:29:47Z")

</div>

What does your Logstash input/output/filter configuration look like?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 28, 2018, 1:30pm UTC](https://discuss.elastic.co/t/syslog-udp-input-plugin-no-message-receive-from-dell-blade-switch/113190/3 "2018-01-28T13:30:02Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.