Get logs from inputs

[nimolvanpersien (Nimol)]

Hi community,
I’m not able to get any log from Syslog UPD port 514 but from UDP RAW port 514.
does anyone know why?

Thanks

[jochen]

Maybe the clients sending invalid syslog messages.

You can check if the input receives any data at all, e. g. using Wireshark or tcpdump.

[nimolvanpersien (Nimol)]

I receive data from them. actually GL also but messages can’t be processed and after a few minutes I get high disk utilization error.

[jochen]

Why can’t they be processed?

[nimolvanpersien (Nimol)]

is there any way to check that why? I can’t see anything in logs!

[jochen]

You could post the logs of your Graylog and Elasticsearch nodes.

http://docs.graylog.org/en/2.3/pages/configuration/file_location.html