RSA Product Set: SecurID
RSA Product/Service Type: Authentication Manager 
RSA Version/Condition: 8.x

RSA Authentication Manager has been configured to send syslog data to a remote syslog server, but no syslog data is arriving at the remote server.

Observable symptoms include one or more of the following:

• The remote syslog server administrator confirms no syslog data is being received from the Authentication Manager appliance, despite the remote syslog destination being configured in Authentication Manager
• Authentication Manager events — including authentication activity, administrative audit events, and system errors — are not appearing in the remote syslog server's log feed
• The syslog configuration in the Security Console appears correct, but the remote syslog server shows no incoming data from the Authentication Manager IP address

Syslog data is not reaching the remote syslog server because a network firewall is blocking outbound UDP port 514 traffic from the Authentication Manager appliance.

Authentication Manager sends syslog data over UDP port 514 from the appliance OS to the configured remote syslog server IP address. If any firewall on the network path between the Authentication Manager appliance and the remote syslog server blocks this traffic, the packets are silently dropped and no error is displayed in the Authentication Manager UI — making the issue difficult to detect without OS-level packet inspection.

This commonly happens when the remote syslog server's own firewall has been opened to accept syslog traffic, but an intermediate network firewall or the Authentication Manager appliance's host firewall still blocks the outbound UDP 514 packets.

Part 1: Verify Syslog Configuration in the Security Console

1. Log in to the Security Console.
2. Navigate to Setup > System Settings.
3. Click Logging.
4. Select Primary or Replica, then click Next.
5. Scroll down to Log Data Destination.
6. Confirm the destination is set to Internal Database and remote Syslog at the following hostname or IP address, and verify the correct syslog server IP address or hostname is entered.

   NOTE: Authentication Manager can send three types of log data to a remote syslog server:

   • Administrative Audit — logs all administrative actions
   • Runtime Audit — logs authentication events
   • System — logs system-level events (e.g., failures to connect to a remote LDAP identity source)

   If the configuration appears correct but the remote syslog server is still not receiving data, proceed to Part 2.

Part 2: Verify Syslog Packets Are Being Sent from the Appliance OS

7. Open an SSH session to the Authentication Manager appliance using the rsaadmin OS account.
8. Switch to the root user:

   sudo su -

   NOTE: The root password is the same as the rsaadmin OS account password unless it was changed after Quick Setup.

9. Check that the syslog service is running:

   service syslog status

   Expected output: The service status should show as running. If it is not running, restart it:

   service syslog restart

10. Verify the syslog process is active:

    ps -ef | grep syslog

    Expected output: One or more syslog process entries should appear in the output.

11. Identify the active network interface on the appliance:

    ip addr show

    Note the name of the interface that carries traffic to the remote syslog server (e.g., eth0, eth1, ens192).

12. Run a packet capture to verify the appliance is sending syslog packets to the remote server:

    tcpdump -i <interface> host <syslog_server_IP>

    Replace <interface> with the interface name from Step 11, and <syslog_server_IP> with the IP address of the remote syslog server.

    CAUTION: tcpdump captures all network traffic on the specified interface. Run it for a short period only and stop it with Ctrl+C when done.

    Expected output: If Authentication Manager is successfully sending syslog packets, output similar to the following will appear:

    HH:MM:SS IP <AM_appliance_IP>.<port> > <syslog_server_IP>.514: UDP, length <n>

Interpreting the Results

Verify: After firewall rules are updated to permit outbound UDP port 514 traffic, trigger a test authentication event in Authentication Manager and confirm the event appears in the remote syslog server's log feed within 60 seconds.