If the mode is set to Keep syslog messages that match any Enabled filter will be forwarded to the SyslogAnalyzer (and processed by RME). If the mode is set to Drop syslog messages that match any Enabled filter wil be discarded. If the mode is set to Keep and you have NO filters enabled, all messages will be forwarded to SyslogAnalyzer. If the mode is set to Drop and you NO filters enabled, all messages will be discarded.