This article explains how to fix the issue if the events are not receiving in JSA via TCP Multiline Syslog

Please do the below checks to identify the issue:

• Check the tcpdump using the below command to find if it is sending the syslog with payload:

tcpdump -v -i any -A host <Log source IP> and port 12468

• Check if you are getting the below error from /var/log/qradar.log:

Nov 13 10:54:17 ::ffff:127.0.0.1 [ecs-ec-ingress.ecs-ec-ingress] [Thread-15695235] com.q1labs.semsources.sources.utils.listener.tcp.TCPSyslogListener: [INFO] [NOT:0000006000][192.168.15.20/- -] [-/- -]TCPSyslogListener on port 12468 accepted connection from /192.168.120.141:44904

Nov 13 10:54:17 ::ffff:127.0.0.1 [ecs-ec-ingress.ecs-ec-ingress] [Thread-15695235] com.q1labs.semsources.sources.tcpmultilinesyslog.TCPMultilineSyslogProvider: [INFO] [NOT:0000006000][192.168.15.20/- -] [-/- -]TCP Multiline Syslog listener on port 12468 read failed, connection reset from 192.168.120.141

Nov 13 10:54:17 ::ffff:127.0.0.1 [ecs-ec-ingress.ecs-ec-ingress] [Thread-15695235] com.q1labs.semsources.sources.utils.listener.tcp.TCPSyslogListener: [INFO] [NOT:0000006000][192.168.15.20/- -] [-/- -]TCPSyslogListener on port 12468 closing connection

Sometimes, TCP syslog may not parse the events properly. To fix the issue, please follow the steps in the solution section.

Follow the below steps:

Change the Log source to UDP Multiline Syslog.

Enable UDP port 517 in the firewall on JSA from System and License Management > Double click on node > navigate to the Firewall tab

Now, you should be able to see the events from UDP Multiline Syslog.