@woodcock I am having the same issue only difference is when my UF attempts again after a few minutes HandShake is achieved and all the applicable apps are pulled down.  This same pattern is happening across a significant number of endpoints.  Any idea why that would be the case?  ... View more

Hi dmpopof, I don't know why you don't have logs from messages file, but I suggest to modify you inputs.conf file in [monitor:///var/log/messages] disabled = false index = linuxlog sourcetype = syslog In this way you're sure to have only the last logs and not the oldest. if you want also the oldest (but I see that you already have) you could use [monitor:///var/log/messages*] Bye. Giuseppe ... View more