How to check if the Zyxel switch sends the logs to syslog server?

Zyxel_Melen

Please try the following troubleshooting steps:

1. Test Connectivity: Navigate to Maintenance > Diagnostic in the web GUI and attempt to ping the syslog server directly from the switch to confirm there is a valid path.
2. Check Local Firewall (if you change syslog port): Confirm that the Linux system's firewall is explicitly allowing incoming traffic on UDP port 51898. Since this is a non-standard port (default is usually 514), the host firewall or the syslog daemon configuration (e.g., rsyslog or syslog-ng) must be specifically set to listen on this port.
3. Trigger a Log Event: To force a log generation for testing, try logging out and back into the switch or toggling a physical port (plug/unplug a cable) and check if any packets are captured on the server via tcpdump or wireshark.

Please note that if you are using Grafana Alloy, please setup a rsyslog server and forward the messages to the Alloy listener with this rsyslog configuration block:

http://. action(

type="omfwd"

target="192.168.1.230" # replace with server hostname or IP

port="51898"

protocol="udp"

Template="RSYSLOG_SyslogProtocol23Format"

)