Did changing the permission for .key solved the issue ? ... View more

no i never did. I used DBconnect to ingest the events ... View more

Can you share you conf file statement that you used ?  Im using the below statement with the the cert, but syslog is not listening to the port.   source source_6514_tls { tcp(port(6514) tls( key-file("/etc/syslog-ng/cert.d/server.key") cert-file("/etc/syslog-ng/cert.d/server.crt") peer-verify(optional-untrusted) ) flags(no-multi-line) ); }; destination dest_6514_local { file("/var/log/syslog/logs"); }; log {source(source_6514_tls); destination(dest_6514_local); }; ... View more

when i click  on test connection after adding the registered server the connection failed, so im not able to connect syslog server with ePO ( i think is because tls required) . I also see that the Splunk Add on required syslog to work. Is there another way to get data from ePo to Splunk ? ... View more