topic Re: IDC Syslog Parser wont receive Syslogs from ClearPass in API / CLI Discussion

IDC Syslog Parser wont receive Syslogs from ClearPass

NemmerAlex — Thu, 03 Apr 2025 14:23:05 GMT

Hi,

i just configured our HP ClearPass to send syslogs to my Identity Collector. I added the IP from the ClearPass with port 514 udp.
I also disabled the windows Firewall. The IDC still wont receive any events.
Does anyone have an idea why i wont receive any events?

Re: IDC Syslog Parser wont receive Syslogs from ClearPass

PhoneBoy — Thu, 03 Apr 2025 16:42:35 GMT

Have you used something like Wireshark to confirm traffic is reaching your IDC system?

Re: IDC Syslog Parser wont receive Syslogs from ClearPass

NemmerAlex — Fri, 04 Apr 2025 05:44:59 GMT

Yes i can see the syslogs in Wireshark via UDP 514. But they wont show up on the Received Events on the IDC

Re: IDC Syslog Parser wont receive Syslogs from ClearPass

PhoneBoy — Fri, 04 Apr 2025 14:32:25 GMT

Perhaps there is something in the various debug log files that might explain it: https://sc1.checkpoint.com/documents/Identity_Awareness_Clients_Admin_Guide/Content/Topics-IA-Clients-AG/Identity-Collector-Debug.htm
Otherwise, I suggest engaging with TAC.