> Source: [sk1000033](https://support.checkpoint.com/results/sk/sk1000033)

# sk1000033 - Identity Collector does not parse Syslog events although Syslog parser test is successful

| Property | Value |
|----------|-------|
| Solution ID | sk1000033 |
| Date Created | 2026-08-24 |
| Last Modified | 2026-08-24 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |
| OS | Windows, Gaia |

## Symptoms

- <br />

* Identity Collector (IDC) is configured to receive Syslog events from a third-party device.

* Network captures or third-party Syslog utilities confirm that Syslog events reach the IDC host and UDP listener port.

* The IDC service is listening on the expected Syslog port.

* The Syslog parser **Test Message** validation appears successful.

* Despite this, IDC does not create Identity Awareness login mappings from the received Syslog events.

* The `ia_client` / Identity Collector logs show that events are received but rejected as non-relevant, for example:

```
NAC::IDCOLLECTOR::ADEVENT::SyslogSubParser::haveSubjectMatch: NO match
NAC::IDCOLLECTOR::SyslogEventQuery::getEvents: Failed to make the event - might be event that we are not interested in
```

## Cause

The **Message Subject** definition in the IDC Syslog parser does not match the actual format of the incoming Syslog event.

In particular, special characters or whitespace in the expected subject may require a regular-expression match. The parser test can appear successful even when the Message Subject expression does not match actual incoming events; consequently, IDC receives the event but does not process it as a relevant identity event.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content