sending syslogs via udp to a sensor from a machine with no elastic agent

[HaydenB0101]

Version

2.4.141

Installation Method

Security Onion ISO image

Description

other (please provide detail below)

Installation Type

Distributed

Location

on-prem with Internet access

Hardware Specs

Exceeds minimum requirements

CPU

12

RAM

32GB

Storage for /

200GB

Storage for /nsm

400GB

Network Traffic Collection

tap

Network Traffic Speeds

1Gbps to 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

I want to send syslogs via UDP(514) from a system that isn't using elastic agent and send the logs to my sensor. I understand from reading the syslog documentation points to the firewall documentation, but nothing there seems helpful.
I have the IP listed under syslog in grid config, and a custom UDP log integration in my policy for the sensor. I have also ensured that port 514 is open on the sensor that will recieve the logs.
What seems like the best place to start looking for issues?

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[cm-ops]

On the sensor, do you see the syslog coming in if you tcpdump the management interface and port 514?