SafeLine WAF Syslog sends test messages only, no real security events

A syslog integration was configured from SafeLine WAF to Graylog, and connectivity between both systems has been successfully verified. However, only test messages (“Connectivity test requested”) are being received, while real security events and detected attacks are not being forwarded. We would appreciate your assistance in reviewing this behavior and guiding us on the required configuration.

Try capturing packets on both SafeLine and the syslog server at the same time.