The Customer has implemented the security log feature on srx5600 and is expected to send Syslogs to an external server, Algosec, however, Syslogs are not received by the Syslog server.

Monitor traffic capture was showing Logs were sent from the SRX however Algosec was not able to show the syslogs.

• From the configuration, I could identify that you have configured an incorrect next-hop for the algosec server IP in the inet.0 routing instance.
• According to the stream logging config, it is expected to send via Logging-vr routing instance, so the expected routing config should have had next-table Logging-vr.inet.0, instead of a next-hop. We have made the required config changes and you need to check from the Syslog server end.
• You have other Syslog server IPs also configured with the incorrect next-hop. As discussed you will work on that once you get a confirmation about the Algosec syslog server.
• I also noticed your Control plane logs were supposed to be generated with Logging-vr interface reth0.100 IP, but it's not sent using that IP, instead, it used the fxp0 interface IP. To fix that you need to use the routing-instance command under the "set system syslog host y.y.y.y" hierarchy.

For the AlgoSec syslog server to work it needs to connect with the SRX over SSH to complete its analysis. Blocking the SSH will stop the logging functionality as well. The customer had asymmetric routing as per the configuration so we had to enable management-instance. Post that we could make the SSH to SRX work from AlgoSec also we could see logs are received by the Algosec (using tcpdump).