Hi
I have a strange case. I attach the sources to Graylog and if it is Windows or Linux Rocky, the logs are sent correctly. If I try to attach logs from Debian 10, it downloads about 25KB and ends. After restart, rsyslog sends 25KB again and finishes sending. I can’t find any information in the Debian 10 logs that anything is wrong. Have any of you encountered such a case?
Can you clarify what try to attach logs from Debian 10 and downloads about 25KB and ends means specifically? How are you shipping the logs and what logs are you shipping?
How do you know it stops at or after 25KB?
You mention rsyslog, is this how you are shipping logs? Are they shipping to graylog using a Syslog input? Can you share your rsyslog configuration?
Hello, I’m replying from the other account.
I use rsyslog, nxlog, sidecars (nxlog) and it’s always the same problem. I think it’s a Debian problem, not graylog itself.
Why do I think so? I did a netcat test and tried to upload a file larger than 25KB. Netcat also only transferred about 25KB. This is the first time I’ve encountered such a problem. The problem only occurs with Debian 10 clients (I haven’t tried other Debians).
My rsyslog config
### Begin forwarding rule for Graylog Log Server
$WorkDirectory /var/spool/rsyslog # Where spool files will live
$ActionQueueFileName nlsFwdRule0 # Unique name prefix for spool files
$ActionQueueHighWaterMark 8000
$ActionQueueLowWaterMark 2000
$ActionQueueMaxDiskSpace 1g # 1GB space limit (use as much as possible)
$ActionQueueSaveOnShutdown on # Save messages to disk on shutdown
$ActionQueueType LinkedList # Use asynchronous processing
$ActionResumeRetryCount -1 # Infinite retries if host is down
*.* @@x.x.x.x:1514
### End of Graylog Log Server forwarding rule
sorry, I was wrong. this is 4KB.
i.e. I send a file using netcat, which is 4.3MB, and in fact on the other side (on Graylog) the netcat client receives and writes to the file only
Sorry again. The system shows me 4KB but the size of the transferred data is 1519 bytes
I think it’s the ufw firewall that’s causing me problems. By default, the ufw firewall has limits set on outgoing and incoming packets