How to check if the Zyxel AP sends the logs to syslog server?

Zyxel_Melen

Please try the following troubleshooting steps:

1. Test Connectivity: Ping the AP's IP from your syslog server.
2. Check Local Firewall (if you change syslog port): Confirm that the Linux system's firewall is explicitly allowing incoming traffic on UDP port 51898. Since this is a non-standard port (default is usually 514), the host firewall or the syslog daemon configuration (e.g., rsyslog or syslog-ng) must be specifically set to listen on this port.
3. Trigger a Log Event: To force a log generation for testing, try logging out and back into the switch or toggling a physical port (plug/unplug a cable) and check if any packets are captured on the server via tcpdump or wireshark.

Please note that if you are using Grafana Alloy, please setup a rsyslog server and forward the messages to the Alloy listener with this rsyslog configuration block:

http://. action(
type="omfwd"
target="192.168.1.230" # replace with server hostname or IP
port="51898"
protocol="udp"
Template="RSYSLOG_SyslogProtocol23Format"
)