There are numerous reasons why a syslog message from a device is not written to syslog.log. They include the device not generating the message (maybe due to a bug), the message not being severe enough to be sent as a syslog message, the message being sent on the wrong facility, a network issue preventing the message from reaching the server, and the syslog daemon not running on the server.
Once a message is written to the syslog.log file, it may then be ignored by the SyslogCollector if the message is not permitted by the configured syslog filters, or SyslogCollector is not running at the time the message is written to the log.
Once SyslogCollector processes the message and deems it to be interesting, it may not get written to the database if the SyslogAnalyzer is not running, or the database is corrupt or otherwise damaged.
