Broker VM cluster - syslog ingestion

weejh — Thu, 19 Mar 2026 09:52:45 GMT

We have activated the Syslog Collector for the broker VM cluster.

Do you have any recommendations on how to verify that it is functioning correctly?

Thanks!

Re: Broker VM cluster - syslog ingestion

Vinothkumar_SBA — Thu, 19 Mar 2026 12:02:26 GMT

Once activated, first check the Broker VM applets. Applets with an error status display an error icon in the Apps column in both the Brokers and Clusters tabs. In specific supported cases, detailed error descriptions are provided for some applets:

Green (Connected): Indicates the applet has no issues.
Orange (Warning): Indicates the applet has minor issues, such as processing errors.
Red (Error): Indicates the applet has application or connectivity errors.

Next, also verify whether the logs are being received. For more information about Broker VM applet health checks, please refer to this link: [https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-3.x-Documentation/Troubleshoot-Broker-VM-applet-errors ].

Please help out other users and “Accept as Solution” if a post helps solve your problem !

topic Re: Broker VM cluster - syslog ingestion in Cortex XSIAM Discussions

Broker VM cluster - syslog ingestion

Re: Broker VM cluster - syslog ingestion