I've setup logscape on a windows 2012 r2 server and successfully have it logging events from 4 remote syslog clients (3 windows 2012 servers and 1 cisco asa appliance). When I initially pointed those servers to the logscape server, the host directory name was created under the ./work tree just as expected. Today, I tried to add some addtional hosts and the directory doesn't auto create nor does any data come over. Any advice on what to check to see what is going on? I've tried disabling the firewall completely on the logscape server and tried a few other hosts, 1 windows and 1 cisco switch but no data comes over. I'd like to mention that currently it is logging data from the initial 4 hosts normally. Thanks for any help.
This may be a configuration problem on the device end. Make sure that you are sending syslog data to port 1468 using TCP and not UDP.
The surest way of confirming your configuration is using a tool similar to tcpdump or wireshark.
