Hi Tim,
I was reviewing this thread because I am having an issue where realtime detection is not working on devices that are on our secondary poller. I noticed in this thread you asked if the device was on a secondary poller. If a device is on a secondary poller, do we need to configure it differently? I'm assuming if the device is on a secondary poller, then in my configuration I should be configuring "logging x.x.x.x" as the poller IP, and not the IP address of my primary server.
I've tried this and it still is not working on these devices. I have moved a device from the primary poller to the secondary, and when I do that, realtime detection stops working. When I move it back, it works fine. When I do move the polling engine, I do change my config so that the logging is going to that matching polling engine.