syslog capture in Meraki

[hmc25000]

We have syslog configured in Network Wide > Configure > General > Reporting. We use a custom port and send "Security Events" however the syslog server is not receiving syslog messages on the server. I tried running a capture but do not see any traffic between the MX and the syslog server.

What would be the source ip address of Meraki syslog messages? Should I be able to view those messages in wireshark?

[BlakeRichardson]

Check out this page and look at the expected traffic flow section.

https://documentation.meraki.com/General_Administration/Monitoring_and_Reporting/Syslog_Server_Overv...

[hmc25000]

Sorry, my message was not clear.  I do not have access to the syslog server, I need to figure out why the syslog server is not receiving the syslog messages. We have syslog configured to send it to a server connected to the inside interface of the MX. I was trying to do a wireshark capture on the lan interface of the MX but don't see any traffic from the inside MX interface to the syslog server. So what would be the source ip address of the syslog messages that are send to the syslog server? 

[RaphaelL]

Sourced by the highest vlan ID on the MX.

[ww]

You should be able to see them in the capture .

How many security event do you see in the security center.  Could it be you just not have that many. 

[hmc25000]

Good point. I am not sure either. I'm having trouble seeing events in the event log. All events say dropped. 

[Brash]

Take a look at this thread. 

@jdsilva  did a lot of testing and found that the source IP will differ dependant on the scenario.

https://community.meraki.com/t5/Security-SD-WAN/Syslog-interface/m-p/52122

[hmc25000]

The thing is in my case the syslog server is in a hub site. The MX sending syslogs is routing traffic through another router connected to the LAN interface to the hub site.