I have been with dozens of client who have improperly configured syslog connectors using the auto feature.
When ever LEM notifies us that it found a new node, I typically cancel it and talk with the networking people if they configured a device to send syslog to LEM. Once confirmed, cmc into LEM and look at the checklogs to validate that the data is coming in the correct facility. Also check if that facility is being used by another connector. If everything checks out, then create a connector using the appropriate facility.
Once that is done, it is very important to create a filter to validate that you are receiving the information you are expecting. Also look for any unmatched data from the connector.
If you notice any unmatched data, then verify that you have the recent revision of the connector. If not, then update the connector and validate.
Validation is a very important step in the process.
Thanks
Amit Shah
Loop1 Systems