Isolate the stage before changing anything
The pipeline has three independent stages. Test them separately rather than guessing.
A minimal listener is enough for the first stage. On the collector host:
5516. Raw datagrams print directly to the terminal, which confirms the network path and shows the exact wire format without any parsing in the way.
No events reach Observe
Work through these in order.1
Wait longer. Allow at least 15 seconds. Checking too early is the most common cause of a false alarm, and it typically sends people investigating firewalls that are working correctly.
2
Confirm forwarding is on. Send
[AOSLFW;FS2;] and check that the response contains FS1 with the address and port you expect, not FS0.3
Confirm the HSM is generating events. Produce a failed login on purpose. An idle appliance with no client traffic may genuinely have nothing to report.
4
Confirm the collector is listening. On the collector host, check that the port is bound:
5
Confirm the network path. The HSM initiates the connection, so the collector must be reachable from the HSM, not merely from your workstation. Test with a plain UDP listener as described above. A test sent from the collector host to its own address proves nothing, because that packet never leaves the machine.
6
Check the host firewall. The listener port must accept UDP from each HSM address.
UDP reports nothing when delivery fails. There is no error on the HSM, no rejection, and no gap marker. Absence of events is therefore not evidence about where the fault lies, which is why isolating each stage matters.
The SLFW command is rejected
The most frequent mistake is sending the logins and the
SLFW command over separate connections. Authorization is tracked per connection and does not persist across reconnects.
Events arrive but the fields are empty
Records reach Observe, buthsm.device, hsm.service, and hsm.level are missing, and the whole event sits in one string beginning with : |.
This means the syslog receiver is in use instead of udplog. The appliance’s format is not standard RFC 3164, and a conforming parser discards the structure without reporting an error. Switch to the udplog receiver with the regular expression from Deploy the OpenTelemetry Collector, and see Appendix A: Futurex syslog message format for the comparison.
Some events are classified as other
The envelope parsed correctly but the message shape did not match any classification rule. Query for hsm.event_type equal to other and inspect hsm.message, then extend the add operators with a new pattern.
This is expected after a firmware upgrade introduces new message text. Because the unmodified datagram is retained in the log body, historical events can be reclassified once the new rule exists.