also have you confirmed that non-event data (aka any other table besides

syslog

) is properly being sent?