I have about 85 devices sending syslog informational traps to LMS, which is sending us email notifications. After a detailed test, I found that LMS did not send email notifications for at least 10 devices.
I checked RME-> Tools -> Report Generator-> Syslog to check if syslog is sending traps to LMS for these devices. I found that, for these 10 devices, there are indeed syslog messages. So now I'm suspecting that there's an issue with the "mail deamon" on LMS.
Check if these devices send the message using a different IP then the management IP.
Use the logging source-interface
I left the default setting, which means that, the source IP address of syslog messages is the router's outbound interface IP address. This configuration has been validated since the corporate firewall allows syslog traffic from this particular interface.
However, as I mentioned earlier, I see that LMS is getting syslogs without sending them all correctly through mail.
If ciscoworks receives a SYSLOG message from an unknown device it will not act upon it.
It has to be a known IP address that he can link to one of its devices.