did you verify you have logs that should be sending? aka you're actually generating sshd logs during the time of the query interval?