It’s closed system so I cant place the command on the sending system.
But the tcpdump output in the first post is a incoming syslog message from the sending system captured on the monitoring server.
Can the format of the message somehow be wrong?
Josef