Port unreachable messages are expected when ECS is not running or port 514 is not open. As a result, JSA will send ICMP messages to the syslog log source with port unreachable as per RFC specification.

ICMP messages are recieved on the log sources that are sourcing from a JSA appliance.

When Event Collection Server (ECS) is down, JSA sends ICMP messages of port unreachable to the syslog sources. If there are enough log sources with a high rate, every event sent could trigger an ICMP port unreachable message for port 514 from the JSA appliance.

Ensure that port 514 is open and that ECS is running on the JSA appliances.  Contact your JTAC representative if you are unable to determine the cause of ECS not running.