# Collecting Syslog **URL:** \ **Category:** Graylog Central (peer support)\ **Created:** [January 14, 2020, 3:57pm UTC](https://community.graylog.org/t/collecting-syslog/13464 "2020-01-14T15:57:27Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![woodworth](https://avatars.discourse-cdn.com/v4/letter/w/f0a364/32.png) [@woodworth](https://community.graylog.org/u/woodworth)\ **Post date:** [January 14, 2020, 3:57pm UTC](https://community.graylog.org/t/collecting-syslog/13464/1 "2020-01-14T15:57:27Z")
I have mt Gray log server configured and added the syslog UDP input but when I setup a couple devices to send logs I am not receiving anything on the Graylog server. I am not sure where to begin looking for a problem as this is all new to me. ---
**Author:** ![woodworth](https://avatars.discourse-cdn.com/v4/letter/w/f0a364/32.png) [@woodworth](https://community.graylog.org/u/woodworth)\ **Post date:** [January 14, 2020, 4:47pm UTC](https://community.graylog.org/t/collecting-syslog/13464/2 "2020-01-14T16:47:17Z")
Running sudo tcpdump -i ens160 host 10.53.9.9 and udp port 5140 I do see traffic but if I just run sudo tcpdump -i ens160 host 127.0.0.1 and udp port 5140 I get nothing. ---
**Author:** ![bahram](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/bahram/32/4874_2.png) [@bahram](https://community.graylog.org/u/bahram)\ **Post date:** [January 14, 2020, 5:37pm UTC](https://community.graylog.org/t/collecting-syslog/13464/3 "2020-01-14T17:37:52Z")
Hi, woodworth > [@Do not received Input Syslog UDP](https://community.graylog.org/t/do-not-received-input-syslog-udp/4871): > > Hello, I do not receive any input messages and I can not start the UDP Syslog entry, when I click on start the input it is still failed. What’s the problem ? Best Regards, ---
**Author:** ![woodworth](https://avatars.discourse-cdn.com/v4/letter/w/f0a364/32.png) [@woodworth](https://community.graylog.org/u/woodworth)\ **Post date:** [January 14, 2020, 7:16pm UTC](https://community.graylog.org/t/collecting-syslog/13464/4 "2020-01-14T19:16:41Z")
Thanks Bahram, That is not my issue I am using 5140 for my input and have my firewall configured to send on the same port. I am able to start the input just fine. Thanks Jeremy ---
**Author:** ![bahram](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/bahram/32/4874_2.png) [@bahram](https://community.graylog.org/u/bahram)\ **Post date:** [January 15, 2020, 5:53am UTC](https://community.graylog.org/t/collecting-syslog/13464/5 "2020-01-15T05:53:13Z")
Can you say more precisely how you do it? ---
**Author:** ![shoothub](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/shoothub/32/6412_2.png) [@shoothub](https://community.graylog.org/u/shoothub)\ **Post date:** [January 15, 2020, 10:19am UTC](https://community.graylog.org/t/collecting-syslog/13464/6 "2020-01-15T10:19:37Z")
Hello @woodworth Your first tcpdump command does make sense, but second not. You tried to dump connections from localhost and port 5140, but there is nothing because, you probably don’t send any logs from localhost. So if you want to show all connection to port 5140, try to use command without “host 127.0.0.1 and”: > tcpdump -i ens160 host 127.0.0.1 and udp port 5140 If you want also check content of the syslog messages use: > sudo tcpdump -nnAs0 -i ens160 udp port 40514 For your problem not getting anything to graylog. Try to check these things: 1. If you are logged as admin user, try to setup correct timezone parameter in server.conf, parameter root\_timezone > vim /etc/graylog/server/graylog.conf > root\_timezone = Europe/Bratislava _Replace Europe/Bratislava with your real timezone._ 1. Restart graylog server sudo systemctl restart graylog.service 2. If not help, maybe your devices use non-standard syslog format without proper timestamp, try to check parameter “Allow overriding date?” in your input 3. If none works try to replace Syslog UDP with RAW UDP Input. Hope this helps. ---
**Author:** ![woodworth](https://avatars.discourse-cdn.com/v4/letter/w/f0a364/32.png) [@woodworth](https://community.graylog.org/u/woodworth)\ **Post date:** [January 15, 2020, 12:09pm UTC](https://community.graylog.org/t/collecting-syslog/13464/7 "2020-01-15T12:09:04Z")
I found the problem. When Setting up the input for bind address I was using 127.0.0.1. For some reason that does not work. When I changed it to 0.0.0.0 everything started flowing in. ---
**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\ **Post date:** [January 29, 2020, 12:09pm UTC](https://community.graylog.org/t/collecting-syslog/13464/8 "2020-01-29T12:09:15Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.