Syslog server not generating syslogs for the device

1. Syslog file won't be generated of the device on the syslog server

2. Reachability will be there from syslog server to switch and vice-versa

1.Check the syslog configuration on the Juniper device(switch)

#run show configuration | display set | match syslog

2. Port 514 is configured as syslog port to allow the traffic.

3. Check if source address is mention correctly and syslog host address

   set system syslog host <syslog server ip> source-address <source-ip>

4. In syslog server, check if source address<address of switch > is added, if not add the same.

5. Check if reachability is there from syslog server to switch and vice-verse.

6. Check if there are any firewall filters configured / any particular routing instance

7. If still issue persists, monitor the interface connected towards the Syslog server

8. Monitor the udp port 514

#run monitor traffic interface <interface from switch toward server> no-resolve
>monitor traffic no-resolve matching "udp and port 514"

9. If following logs are seen, it means that switch is not able to reach 514 port to server to get the logs generated.

11:44:41.943963 In IP <server ip> > <switch ip>: ICMP <server ip> udp port 514 unreachable, length 167

11:44:41.944001 In IP <server ip> > <switch ip>: ICMP <server ip> udp port 514 unreachable, length 167

11:44:41.944292 In IP <server ip> > <switch ip>: ICMP <server ip> udp port 514 unreachable, length 164

10. Either the port is blocked / not allowed because which we are facing the issue .

     (I) Need to trace the port why is it blocked

     (II) Check if port 514 is enabled on the server end .

    (III) Enable the port on server end .

2023-1229-038683