I've tried to comb all manner of areas looking for answers on this. We've enabled the nxlog plugin at the global level (on Sensor Configuration-->Collection). The plugin appears to be enabled correctly, as we've been trolling around in Jailbreak/CLI mode.
Plugin listed in /etc/ossim/agent/config.cfg (nxlog=/etc/ossim/agent/plugins/nxlog.cfg)
We see the plugin enabled/running in /var/log/alienvault/agent/agent.log (nxlog Total lines  TotalEvents: EPS: [0.00] elapsed [10.01] seconds) and (plugin (nxlog) is enabled) messages
Ran tcpdump to validate a remote Windows host running Nxlog is communicating with USM over UDP 514
tcpdump -n -i eth0 -vvvvv host <IP ADDRESS> and udp port 514
Can see the actual syslog events sent from the Windows host in /var/log/alienvault/devices/<IP ADDRESS>/<IP ADDRESS>.log
Not sure if this is the issue and why events are going here