Before you post: Your responses to these questions will help the community help you. Please complete this template if you’re asking a support question.
Don’t forget to select tags to help index your topic!
I just installed GrayLog in an protected network zone. My systems in that zone, are normally not allowed to access the internet, for security reasons.
However on my firewall I see that GrayLog constantly tries to access 22.214.171.124 and 126.96.36.199 Addresses which do not belong to anyone conform whois . What ever I tend to block this!
No reason to access the internet, apart from updates, as far as me is concerned.
1. Describe your incident:
2. Describe your environment:
- Service logs, configurations, and environment variables:
3. What steps have you already taken to try and solve the problem?
4. How can the community help?
Helpful Posting Tips: Tips for Posting Questions that Get Answers [Hold down CTRL and link on link to open tips documents in a separate tab]
$ whois 188.8.131.52
# available at: https://www.arin.net/resources/registry/whois/tou/
# If you see inaccuracies in the results, please report at
# Copyright 1997-2022, American Registry for Internet Numbers, Ltd.
NetRange: 184.108.40.206 - 220.127.116.11
Parent: NET172 (NET-172-0-0-0-0)
NetType: Direct Allocation
Organization: Cloudflare, Inc. (CLOUD14)
Comment: All Cloudflare abuse reporting can be done via https://www.cloudflare.com/abuse
OrgName: Cloudflare, Inc.
Address: 101 Townsend Street
City: San Francisco
Why does GL need to contact CloudFlare? One of the reasons I can think of is to check whether there is a new version out there (graylog.org DNS is handled by CloudFlare). And, if there is one, I am sure you’d like to keep your GL server up-to-date with the latest and greatest features and bug fixes.
Yep, but CloudFare is just like Amazon just ‘Cloud’ Every body can hide there !!!
The only address I would accept is .graylog.com !!
Surely for ‘servers in the green zone’.
It like emails I receive from xyz.com 'On behalf of supplier . There is no guaranty at all that that is true. So I tend to throw those mails away …
Out of curiosity do you have the Enterprise Plugins install?
No, I am private user using graylog to collect alarms from pfsense and in the future probably other computers in my network.
You can disable Graylog version check by setting the following parameter in server.cong:
versionchecks = false
(Don’t forget to restart Graylog service)
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.