Gl2_remote_ip issue with docker

Hi all,

I am running graylog as container on my unraid server. I have a few different devices on my internal network (192.168.0/24). I have a UDP syslog input setup and working and all my messages are coming in just fine. The problem is that the gl2_remote_ip field is being populated with the docker private network gateway, not the actual 192* IP of the sending device. Any advice on how to fix this would be much appreciated!


Thats kind of weird the “gl2_remote_ip” field should always exist unless you’ve removed it in a pipeline rule or gl2_remote_ip is being set only if the raw message (received by the network transport) does contain information about the remote address.

For troubleshooting maybe try a different INPUT for your remote devices and another input with your localhost.

I do not have any pipeline rules configured. The field is getting populated, it’s just getting the internal docker container IP vs the actual device IP. I’ll try a separate input and see what happens.

I finally got things working again. I created a new input on a different port, changed my sources to log to that input. Oddly, it also worked just fine again when I switched the sources back to the original input.

I assume the new input created the correct Gl2_remote_ip?

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.