The best way to troubleshoot this is to run a test while debugging syslog.

Enable debugs for syslog under RME - Admin - Preferences - Loglevel Settings

Set SyslogAnalyzer to debug

Stop SyslogCollector and SyslogAnalyzer processes (pdterm).

In the collector.properties file, set "DEBUG_LEVEL=DEBUG"

Clear the contents of the following log files:

$NMSROOT\log\SyslogCollector.log

$NMSROOT\log\SyslogAnalyzer.log

$NMSROOT\log\AnalyzerDebug.log

$NMSROOT\log\SyslogAnalyzerUI.log

Start SyslogCollector and SyslogAnalyzer processes (pdexec)

Now go a device that is managed in RME and do a conf t and exit. This should generate a config change syslog.

Make sure it hits the syslog_info and then wait a few minutes and generate a standard report for this device. Does it appear?

If not look in the 4 log files above for the device IP or hostname....what does it show?

Do the drop or invalid message counters increase?