1 Rookie
•
54 Posts
0
21
August 26th, 2025 01:45
If iDRAC not sending logs to Syslog server on port 514 ?
The syslog server is not receiving any logs from idrac, when customer perform packet capture switch port connected with idrac, From wireshark - it show random port instead of port number 514 for the destination port, What could be the issue ?
Below is the idrac firmware version.
| iDRAC & LC | 7.00.00.174 |
No Events found!
DELL-Chris H
Moderator
•
9.5K Posts
0
August 26th, 2025 13:11
Leejunloong,
There can be a few different things causing the issue.
1. Incorrect Port Configuration
iDRAC allows you to customize the destination port.
If the port was changed accidentally or not set explicitly, it may default to an incorrect value.
Verify in the iDRAC Web UI:
Overview > Server > Logs > Settings
Ensure Remote Syslog is enabled
Confirm Syslog Server IP and Port = 514
Click Apply after changes
2. Alert Filters Not Enabled
iDRAC only sends syslog messages for enabled alert categories.
Go to:
Overview > Server > Alerts
Enable Remote System Log for desired alert types
Click Apply
3. License Limitation
Remote syslog requires an Enterprise license.
Check under Overview > Server > Licenses to confirm license status.
4. Firewall or Network ACLs
Ensure that UDP port 514 is open between iDRAC and the syslog server.
Confirm that the syslog server is listening on port 514 and not filtering based on source IP or port.
I would start with checking those.
Let me know if this helps.