Water-utility ESXi hosts and NSX-T Edge nodes are configured to send syslog to a SIEM, but no events arrive after a network change. Some nodes use UDP 514 and others use TLS TCP 6514. What should the administrator test first?
Select an answer to reveal the explanation.
Short Explanation
Remote logging is just another pipe. If someone capped that pipe — wrong port, dead route, or a TLS cert the SIEM hates — ESXi and Edge stay mute even when the syslog setting on the host looks perfect. Test 514/6514 and the certificates before rewriting DFW.
Full Explanation
When water-utility ESXi hosts and NSX-T Edge nodes are configured to send syslog to a SIEM but no events arrive after a network change, and some nodes use UDP 514 while others use TLS TCP 6514, verify IP connectivity and certificates for UDP 514 and TLS TCP 6514 from the hosts and Edges to the SIEM first. Syslog fails when the physical path or TLS trust breaks; mixed protocols mean both UDP and TLS paths must be validated. Restoring those civic logging paths returns security telemetry. Recreating Distributed Firewall Application sections on the syslog collector so Guest Introspection can inject logs fails by concept because recreating DFW sections and GI injection do not fix host/Edge syslog transport to the SIEM. Enrolling the SIEM as a Workspace ONE UEM syslog profile so Intelligent Hub forwards NSX logs fails by concept because UEM/Hub is not the transport for ESXi and Edge syslog. Moving syslog to Carbon Black Cloud Live Query so endpoint sensors replace ESXi logging fails by concept because Live Query does not replace infrastructure syslog from hosts and Edges. Exam caveat: missing syslog after network change means test UDP 514 and TLS 6514 path and certs—product substitutions are distractors. Operational check: from hosts and Edges test connectivity to SIEM on the configured protocols, fix ACL/NAT/cert issues, confirm events arrive, and document dual-protocol syslog requirements in the water-utility logging standard for municipal OT visibility.