My Graylog server is busy collecting logs from both linux (rsyslog), Mac (syslog) and Windows (nxlog using syslog) clients. Being a government agency, we need to archive logs for a certain time. We have an Arcsight log collector that I would like to send all incoming Graylog messages to. It’s running syslog on udp/514 just to make this discussion easier. I configured the syslog output on the Graylog server and aimed it at a Linux machine running rsyslog for incoming udp/514 message. The messages show up on the rsyslog server but there are a few extra fields at the beginning of each log entry. I’ve set the output to plain, structured, ref and full message types, but I don’t get the same log as the Graylog server received. I would think I could just bounce the messages off the incoming stream directly to the remote syslog server, but it’s not working.
- Is it possible to use the rsyslog service to accept incoming messages on Graylog and have those as input? That way I could easily add “.. @machinename” to the rsyslog.conf and send the messages to the remote server.
If not, I could set up the archive server and then use the same idea to send the messages to Graylog. I’m not sure if the Arcsight collector will do that, but I think it will. I would just have to change firewall rules and some IP addresses to get traffic where it needed to go.
Here is a sample of the original message (dimmitt is the machine name):
Mar 29 15:45:44 dimmitt pcscd: commands.c:959:CmdGetSlotStatus Card absent or mute
Here is the log after Graylog munges it somehow:
Mar 29 15:45:44 dimmitt user-level - dimmitt pcscd: commands.c:959:CmdGetSlotStatus Card absent or mute