Water-utility ESXi hosts and NSX-T Edge nodes are configured to send syslog to a SIEM, but no events arrive after a network change. Some nodes use UDP 514 and others use TLS TCP 6514. What should the administrator test first?
Select an answer to reveal the explanation.
Short Explanation
Remote logging is just another pipe. If someone capped that pipe — wrong port, dead route, or a TLS cert the SIEM hates — ESXi and Edge stay mute even when the syslog setting on the host looks perfect. Test 514/6514 and the certificates before rewriting DFW.
Full Explanation
vSphere and NSX-T Edge remote logging typically use syslog on UDP/TCP 514 or TLS on TCP 6514. After a network change, missing routes, blocked ports, or TLS certificate trust failures prevent events from reaching the SIEM even when the syslog configuration on the source is correct. Distributed Firewall Application policy on a collector VM, Workspace ONE UEM profiles, and Carbon Black Live Query are not the transport for ESXi or Edge syslog. Test reachability and certificate validity along the logging path, then re-check the SIEM intake.