I have two Cisco Ironports running v7.6.2-014. I'm trying to get them to syslog to Eventlog Analyzer. I've configured the Ironports to Syslog push their logs to the Eventlog server, and I can see that the server receives the messages but it won't add the messages to a host.

If  I start the Syslog Viewer from the web interface in Aventog Analyer I can see the incoming messages:

10.16.0.7	10.16.100.25	514	|38|Jan 23 12:16:38 updater_logs: Info: case cleaning up base dir [bindir]
10.16.0.7	10.16.100.25	514	|38|Jan 23 12:16:38 updater_logs: Info: case verifying applied files
10.16.0.7	10.16.100.25	514	|38|Jan 23 12:16:38 updater_logs: Info: case updating the client manifest
10.16.0.7	10.16.100.25	514	|38|Jan 23 12:16:38 updater_logs: Info: case update completed
10.16.0.7	10.16.100.25	514	|38|Jan 23 12:16:38 updater_logs: Info: case waiting for new updates
10.16.0.7	10.16.100.25	514	|110|Jan 23 12:16:44 antispam: Info: case antispam - engine (47561) : startup: Region profile: Using profile global
10.16.0.7	10.16.100.25	514	|110|Jan 23 12:16:44 antispam: Info: case antispam - engine (47561) : logger: removing stderr method

However, the messages won't be added to the host:

	Host | Show IP		Error	Warning	Failure	Others	Total	Status	Last Message On	Host Group
	10.16.0.7		0	0	0	0	0		-	UnixGroup

Any ideas?