Use ngrep to capture syslog traffic

May 23, 2018

Instead of using wireshark on Linux to capture traffic try ngrep

# sudo ngrep -d <interface> '<search string>' 'port 514'

source:
http://ngrep.sourceforge.net/usage.html