Thanks for providing the root cause info. I will remember to check the syslog port(514) usage status using netstat.