A new syslog server has been setup and configured for use in EDR (SEDR), but EDR is forwarding data to the old server still.
The license for EDR expired and it was not renewed immediately. EDR normally would automatically register the new license, but if there is a network device or configuration that blocks communication with the backend server this automated process cannot occur. A firewall or a proxy could have this effect on an EDR appliance's behavior. You may find that the license registration has failed as a result of one or both of these being configured incorrectly in your environment.
Release : 4.6.0
Network based firewall or proxy server
In this situation a 'network proxy' should be configured and not an 'enterprise proxy' unless an enterprise proxy (or proxies) exist in your environment also. These should not be the same address.