One working cluster is R80.40 not latest JHF. The other working cluster is R81 latest JHF.
The non-working cluster is also R81 latest JHF.
All the clusters are managed by the same management server (R81 latest JHF).
Went through sk31832, checked the table.def on the management server (cat $FWDIR/lib/table.def | grep no_hide_services_ports).
no_hide_services_ports = { <4500,17>, <500, 17>, <259, 17>, <1701, 17>, <5500, 17>};
I would modify table.def on management to reflect the below for syslog traffic:
no_hide_services_ports = { <4500,17>, <500, 17>, <259, 17>, <1701, 17>, <5500, 17>, <514,17>};
but I would rather not to since the other two clusters are working.
I will investigate more tomorrow and if I have any update I will post here.
Thank you.