Unable to collect logs from Cisco Nexus

[gsmith]

Hello && Welcome

Have you tried to use RawPlaintext UDP/TCP inputs instead?

Might want to check this post out

NAT with Redirect

For removing rules I found something that works 100%. First list all the rules, including their line number. iptables -t nat -L -n -v --line-number You find the line number of the rule you want to delete and then execute: iptables -t nat -D PREROUTING {rule-number-here} Works like a champ. I’ve never need to do the -F. I’ve always been looking for a way to have different extractors for different types of devices, but hit a brick wall when I have multiple devices that all want to use udp/5…

Hope this helps

EDIT: My apologies I missed a couple statements you made.

@b2s

The Nexus switch was showing a “unreachable server” error until I restarted the syslog server, I searched about this online and it seems to be a bug of the switch.

If all your other devices are working with iptables prerouting (514) and you tested just Nexus switch and do not see messages coming in then running tcpdump and do not see Nexus Switch I would have agree something is up with the switch.

Are you able to see any logs on the Nexus switch using the TCP connection? or Graylog’s log file that may pertain to a connection issue?
By chance do you have any ACL’s on the nexus switch?