# Graylog 3.0 doesn't get syslog messages anymore from newish rsyslog versions **URL:** \ **Category:** Graylog Central (peer support)\ **Created:** [January 29, 2019, 9:30am UTC](https://community.graylog.org/t/graylog-3-0-doesnt-get-syslog-messages-anymore-from-newish-rsyslog-versions/8570 "2019-01-29T09:30:03Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![Mattia.D](https://avatars.discourse-cdn.com/v4/letter/m/e480ec/32.png) [@Mattia.D](https://community.graylog.org/u/Mattia.D)\ **Post date:** [January 29, 2019, 9:30am UTC](https://community.graylog.org/t/graylog-3-0-doesnt-get-syslog-messages-anymore-from-newish-rsyslog-versions/8570/1 "2019-01-29T09:30:03Z")
Hi, after managing to update to Graylog 3.0 (because the UI was bugging me to update), I noticed that all our newer servers do not send syslog messages to Graylog anymore. The only servers for which logs still come in are the old ones (we are talking wheezy here). The error thrown by rsyslogd is ``` 3661.491220099:main Q:Reg/w0 : Called LogMsg, msg: unexpected GnuTLS error -28 in nsd_gtls.c:1755: Resource temporarily unavailable, try again. rsyslogd: unexpected GnuTLS error -28 in nsd_gtls.c:1755: Resource temporarily unavailable, try again. [v8.24.0 try http://www.rsyslog.com/e/2078] ``` gnutls-cli works fine and connects. Does someone have a clue to why this is? I have been trying for a few hours to figure out what the problem is but I can’t put my finger on it. GELF still seems to work fine. Thanks ---
**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\ **Post date:** [January 29, 2019, 9:58am UTC](https://community.graylog.org/t/graylog-3-0-doesnt-get-syslog-messages-anymore-from-newish-rsyslog-versions/8570/2 "2019-01-29T09:58:05Z")
The UI does not nack you for a beta version … How did you configure what and how could we try to rebuild what you have to check where the error might be? ---
**Author:** ![Mattia.D](https://avatars.discourse-cdn.com/v4/letter/m/e480ec/32.png) [@Mattia.D](https://community.graylog.org/u/Mattia.D)\ **Post date:** [January 29, 2019, 10:29am UTC](https://community.graylog.org/t/graylog-3-0-doesnt-get-syslog-messages-anymore-from-newish-rsyslog-versions/8570/3 "2019-01-29T10:29:30Z")
I’ve got a Syslog TCP input with TLS setup. It uses a Let’s Encrypt Certificate. Single node. On the client I have the same config on all servers (mostly Debian 8 & 9). ``` $DefaultNetstreamDriverCAFile /etc/ssl/certs/DST_Root_CA_X3.pem $DefaultNetstreamDriver gtls $ActionSendStreamDriverMode 1 $ActionSendStreamDriverAuthMode anon *.* @@(o)SERVERADDRESS:8514;RSYSLOG_SyslogProtocol23Format ``` The UI was showing me something that looked like an error message telling me to upgrade following a link. When I clicked on the link it showed me that the latest version was 3.0 and how to upgrade. I did not realise until now that you told me that 3.0 is still in beta. I reckon it wasn’t clear enough and I didn’t see it. But now here I am and I’m not going to downgrade. Thanks ---
**Author:** ![Ponet](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/ponet/32/2131_2.png) [@Ponet](https://community.graylog.org/u/Ponet)\ **Post date:** [January 29, 2019, 11:05am UTC](https://community.graylog.org/t/graylog-3-0-doesnt-get-syslog-messages-anymore-from-newish-rsyslog-versions/8570/4 "2019-01-29T11:05:48Z")
This issue appears to be with rsyslog and not Graylog. The thread which can be found via the link provided in the error message states: > A common cause is that the file can not be found or accessed (permissions!). > **[rsyslog error 2078 - rsyslog](https://www.rsyslog.com/rsyslog-error-2078/)** > > Error adding (TLS) certificate This message occurs with TLS netstream driver. For TLS, certificates (.pem files) are needed to provide security credentials. This error is issued if there is a problem with these files. The message contains a more... First thing to check is that `/etc/ssl/certs/DST_Root_CA_X3.pem` exists and is readable. ---
**Author:** ![Mattia.D](https://avatars.discourse-cdn.com/v4/letter/m/e480ec/32.png) [@Mattia.D](https://community.graylog.org/u/Mattia.D)\ **Post date:** [January 29, 2019, 11:30am UTC](https://community.graylog.org/t/graylog-3-0-doesnt-get-syslog-messages-anymore-from-newish-rsyslog-versions/8570/5 "2019-01-29T11:30:49Z")
Yes, the file does exist and is readable. It did work before I upgraded Graylog. Just to test I even took the intermediate LE X3 certificate and put it somewhere else and tried to use that. I did read through that link when I saw the error message. It’s not like I came directly here before doing some research. Posting in forums is a last resort for me. Thank you for understanding. ---
**Author:** ![macko003](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/macko003/32/3175_2.png) [@macko003](https://community.graylog.org/u/macko003)\ **Post date:** [January 29, 2019, 12:01pm UTC](https://community.graylog.org/t/graylog-3-0-doesnt-get-syslog-messages-anymore-from-newish-rsyslog-versions/8570/6 "2019-01-29T12:01:30Z")
just some tips for debuging use openssl in client mode to verify the graylog’s cert over TLS connection. check your java settings, as far as i know you need to modify the java certstore, the new GL install use your old certstore? ---
**Author:** ![Mattia.D](https://avatars.discourse-cdn.com/v4/letter/m/e480ec/32.png) [@Mattia.D](https://community.graylog.org/u/Mattia.D)\ **Post date:** [January 30, 2019, 9:18am UTC](https://community.graylog.org/t/graylog-3-0-doesnt-get-syslog-messages-anymore-from-newish-rsyslog-versions/8570/7 "2019-01-30T09:18:51Z")
I’ve used both gnutls-cli and the openssl client to test the connection; it works and when I type something in it appears in Graylog. I have never set a certstore in Graylog or changed the Java default certstore. Certstore wise it’s all default. I will try to create another input on a different port, just to see if the config of the input got messed up. Thanks. ---
**Author:** ![Mattia.D](https://avatars.discourse-cdn.com/v4/letter/m/e480ec/32.png) [@Mattia.D](https://community.graylog.org/u/Mattia.D)\ **Post date:** [January 30, 2019, 11:04am UTC](https://community.graylog.org/t/graylog-3-0-doesnt-get-syslog-messages-anymore-from-newish-rsyslog-versions/8570/8 "2019-01-30T11:04:04Z")
It works with the second input I created. I’ve set only the necessary and left everything else default. Here is the diff of the config that is shown in the UI: ``` $ diff --color input1.txt input2.txt 5a6 > number_worker_threads: 2 7c8 < port: 8514 --- > port: 9999 12c13 < tls_client_auth: optional --- > tls_client_auth: disabled ``` Something must have gotten messed up in the internal configs. Is there some debugging I can do for you? ---
**Author:** ![macko003](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/macko003/32/3175_2.png) [@macko003](https://community.graylog.org/u/macko003)\ **Post date:** [January 30, 2019, 11:48am UTC](https://community.graylog.org/t/graylog-3-0-doesnt-get-syslog-messages-anymore-from-newish-rsyslog-versions/8570/9 "2019-01-30T11:48:29Z")
```auto tls_client_auth : disabled ``` the GL won’t auth the client. If you want you have to add the CA to the java cert store AND/OR (i’m not sure) you can also put the acepted cert in a dire, and config the dir under the input. ( tls\_client\_auth\_cert\_file) Check the official docs: [http://docs.graylog.org/en/2.4/pages/configuration/https.html](http://docs.graylog.org/en/2.4/pages/configuration/https.html) So as I see you set client auth without tell GL who are the trusted clients. ---
**Author:** ![Mattia.D](https://avatars.discourse-cdn.com/v4/letter/m/e480ec/32.png) [@Mattia.D](https://community.graylog.org/u/Mattia.D)\ **Post date:** [January 30, 2019, 1:09pm UTC](https://community.graylog.org/t/graylog-3-0-doesnt-get-syslog-messages-anymore-from-newish-rsyslog-versions/8570/10 "2019-01-30T13:09:48Z")
That’s because I have never had authentication setup and optional vs. disabled should not make a difference. I guess the default for tls\_client\_auth has changed from optional to disabled so that’s why it’s different. I’ll change it anyways to disabled in the original input to see if a config change triggers something and repairs the input. Thank you anyways. ---
**Author:** ![Mattia.D](https://avatars.discourse-cdn.com/v4/letter/m/e480ec/32.png) [@Mattia.D](https://community.graylog.org/u/Mattia.D)\ **Post date:** [January 30, 2019, 1:38pm UTC](https://community.graylog.org/t/graylog-3-0-doesnt-get-syslog-messages-anymore-from-newish-rsyslog-versions/8570/11 "2019-01-30T13:38:24Z")
Setting tls\_client\_auth to disabled fixes the original input. Putting it back to optional breaks it again, so I’m going to leave it to disabled. So this has to be some sort of bug because the behaviour of ‘optional’ has changed since the last release. As I said, before the upgrade it worked. Thanks for the help. ---
**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\ **Post date:** [February 13, 2019, 1:38pm UTC](https://community.graylog.org/t/graylog-3-0-doesnt-get-syslog-messages-anymore-from-newish-rsyslog-versions/8570/12 "2019-02-13T13:38:28Z")
Closed on February 13, 2019, 1:38pm UTC This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.