Graylog 4.2.4 is not parsing all syslog messages it receives

Graylog Central (peer support)
1

Hi guys,

I have just installed Graylog 4.2.4 in my home environment; please see details below:
MongoDB shell version v4.4.10
Elasrichserach version 7.10.2

For some reason, Graylog only displays messages that it receives from the same network (192.168.1.0/24).
It also gets Syslog messages from other networks (192.168.4.0/24 and 192.168.14.0/24), but they don’t appear in the search:

root@graylog:~# tcpdump -i eth0 net 192.168.4.0/24 or net 192.168.14.0/24
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes
18:48:04.627106 IP 192.168.14.1.48250 > graylog.syslog: SYSLOG daemon.info, length: 119
18:48:05.609281 IP 192.168.4.27.49892 > graylog.syslog: SYSLOG user.info, length: 305
18:48:05.634475 IP 192.168.14.1.48250 > graylog.syslog: SYSLOG daemon.info, length: 118
18:48:05.911361 IP 192.168.14.44.58829 > graylog.syslog: SYSLOG kernel.warning, length: 131
18:48:05.929977 IP 192.168.14.44.58829 > graylog.syslog: SYSLOG daemon.notice, length: 216
18:48:05.930884 IP 192.168.14.44.58829 > graylog.syslog: SYSLOG kernel.warning, length: 142
18:48:06.137461 IP 192.168.14.44.58829 > graylog.syslog: SYSLOG daemon.notice, length: 216
18:48:06.139261 IP 192.168.14.44.58829 > graylog.syslog: SYSLOG kernel.warning, length: 128
18:48:07.215159 IP 192.168.4.27.49892 > graylog.syslog: SYSLOG daemon.notice, length: 239
18:48:08.609482 IP 192.168.4.24.34311 > graylog.syslog: SYSLOG user.info, length: 273
18:48:08.757890 IP 192.168.14.1.48250 > graylog.syslog: SYSLOG daemon.info, length: 131
^C
11 packets captured
11 packets received by filter
0 packets dropped by kernel
root@graylog:~#

tcpdump shows that the server gets messages but they dont seem to get parsed:

no_logs
no_logs1904×454 33 KB

Input setting below:

UDP Syslog Input Syslog UDP

RUNNING

On node 72209db4 / graylog

  • allow_override_date:

true

  • bind_address:

192.168.1.11

  • expand_structured_data:

false

  • force_rdns:

false

  • number_worker_threads:

4

  • override_source:

  • port:

1514

  • recv_buffer_size:

262144

  • store_full_message:

true

Thanks,
myky

2

False-positive, guys.
Logs are now displayed:

logs

It took some time tho

1 Like
3

Nice, Could you explain how you resolved this?

4

Hey @gsmith

I haven’t done anything tbh, eventually, I could see all logs in the dashboard after some time (I had a fresh install).

Thanks,
myky

5

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.