1. Describe your incident: I am setting up a syslog-ng server to forward received syslogs to Graylog. Graylog can receive forwarded syslogs, but marking the source as the syslog-ng server, not the real host who generates the syslogs originally. 2. Describe your environment: OS Information: Red …

Hello, Can you show message/s received By Graylog from Syslog-ng server.

[Screen Shot 2022-06-02 at 9.48.23 PM]

In this syslog message, the source IP is 172.18.1.10, which is the syslog-ng server; and the device generated syslog originally is sxxx.net.uoguelph.ca.

Hello, I understand now. Quick question, I see your using RawPlaintext UDP with port 8514. I 'm not seeing that port on you configuration above? Have you tried to use Syslog UDP input? If so did you get the same out come?

@UoGuelph After read up-on syslog-ng there was a statement made awhile back using GELF input which is native to Graylog. Graylog as destination in syslog-ng - Blog - syslog-ng Community - syslog-ng Community The reason for this was I was thinking if a different input could sort this out ( creat…

Yes, I tried Syslog UDP first, then tried RawPlaintext UDP, same result. The traffic is from the syslog-ng server (172.18.1.10), which is right, but how Graylog knows which syslogs are forwarded, and which ones are generated from the source?

@UoGuelph I’m not sure if you caught this post. [image] gsmith: @UoGuelph After read up-on syslog-ng there was a statement made awhile back using GELF input which is native to Graylog. Graylog as destination in syslog-ng - Blog - syslog-ng Community - syslog-ng Community The reason for thi…

Version 3.13 of syslog-ng introduced a graylog2() destination and a GELF (Graylog Extended Log Format) template to make sending syslog messages to Graylog easier. We are running syslog-ng 3.5, so an upgrade is required. I am also thinking “create an Extractor/Pipeline so it places that messages so…

[image] UoGuelph: I am also thinking “create an Extractor/Pipeline Probably you best bet right now.

Might want to check this post out. Extract the hostname

Forwarding syslogs from syslog-ng server to Graylog

Graylog Central (peer support)

gsmith (GSmith) June 3, 2022, 2:52am 11

Might want to check this post out.

Extract the hostname

Topic		Replies	Views
Multiple servers forwarding to Graylog Graylog Central (peer support)	4	2492	November 30, 2017
Syslog ships to graylog but without source details Graylog Central (peer support)	3	1444	May 21, 2019
Graylog with NGINX udp proxy, keep source ip Graylog Central (peer support) pipeline-rules	1	943	November 5, 2020
Graylog + Nginx Load Balanced Syslog - Source is the Load Balancer Graylog Central (peer support)	2	4062	April 26, 2017
Replay syslog logs to graylog Graylog Central (peer support) sidecar , nxlog , nodatanx	4	2595	June 18, 2017

Forwarding syslogs from syslog-ng server to Graylog

Related topics