A new syslog server has been setup and configured for use in EDR (SEDR), but EDR is forwarding data to the old server still.
Release : 4.6.0
Network based firewall or proxy server
The license for EDR expired and it was not renewed immediately. EDR normally would automatically register the new license, but if there is a network device or configuration that blocks communication with the backend server this automated process cannot occur. A firewall or a proxy could have this effect on an EDR appliance's behavior. You may find that the license registration has failed as a result of one or both of these being configured incorrectly in your environment.
In this situation a 'network proxy' should be configured and not an 'enterprise proxy' unless an enterprise proxy (or proxies) exist in your environment also. These should not be the same address.