My setup is FW, WAF and Web-proxy logs being pushed to my Rsyslog Fwd which has a UF installed to push to my indexers. So my logs that were coming from the Rsyslog server stopped mysteriously around 3am a few nights back, but the UF installed on that server is still sending out metrics logs but no firewall logs. I can't figure what the issue is. Whats even weirder is that all the logs didn't stop at one time but over a course of few hours, the logs had been coming in consistently for a few weeks now. And this new deployment had been running about a 4-5 weeks. There was a sharp increase in logs that came in the day of and after that the logging levels dropped to almost none with only the UF metrics getting indexed but no other logs. • Host OS: Red Hat Linux 7.3 • Syslog software used: rsyslogd 7.4.7 • Splunk Software used: Splunk Universal Forwarder 6.6.3 for Linux • Configuration changes to get syslog data from sources was done in /etc/rsyslog.d/rsyslog-splunk.conf. • Logrotation for syslog data was configured in /etc/logrotate.d/rsyslog-splunk Any ideas? ... View more