So this initially looks like the sender does not have certs, what is 192.168.100.1? (The client sending should now have the TLS certs - what does the outputs from client (UF ) look like? Test from the client openssl s_client -connect <hostname>:9997 Or  /opt/splunkforwarder/bin/splunk cmd openssl s_client -connect <hostname>:9997 ... View more

I checked with tcpdump and wireshark. I can clearly see the TCP packets, but not the UDP packets. However, I can see the traffic by echoing the message (TCP and UDP as well) to SC4S server. I believe its the issue of the Kiwi Syslog Message Generator.  Thanks guys. 😊 ... View more