Listening SYSLOG messages with ngrep or tcpdump

You can test your SYSLOG forwarding with this commands at the receiving server.

tcpdump -vv -i eth1 port 514 | grep 10.1.5.115

or

ngrep -d any host 10.1.5.115 and port 514

Change the IP address and network interface according to your use case.