A cloud administrator updates the syslog forwarder configuration on a local server in production to use a different port. The development team is no longer receiving the audit logs from that server…

If the development team were simply querying the wrong server, the security team querying the correct server would not explain the discrepancy because the scenario confirms both teams reference the same server.

When the forwarder port was changed, logs began routing to a different log aggregation endpoint - most likely the security team's SIEM or centralized log platform. The security team can access the logs because they hold the necessary permissions on that destination system, while the development team does not have equivalent rights to query or retrieve data from it. The permission differential between the two teams fully explains why one group sees the logs and the other does not, despite both targeting the same source server.

If audit logging were disabled on the server, no logs would be generated at all, so the security team would also be unable to retrieve logs - which directly contradicts the stated facts.

A wrong listening port on the development team's syslog collector would prevent ingestion on their system, but this is a transport issue and does not account for why the logs are already present and searchable by the security team.