Splunk Syslog- Does anyone know of a way that I can check if a system is reporting into my log server?

[Johnny5]

Does anyone know of a way that I can check if a system is reporting into my log server

[VijaySrrie]

index=_internal host=hoatname or IP

[richgalloway]

tcpdump

[jotne]

Syslog are normal UDP, so tcpdump will not work.

[PickleRick]

Too bad mine doesn't know it 😉

https://opensource.com/article/18/10/introduction-tcpdump

[jotne]

May fault, just assumed TCPDUMP was for TCP only, but according to manual it can look at UDP and ICMP as well.  Bad name of the application 😉