Graylog connects to AWS why?

Hi All,

I am very new to Graylog. Infact, I just made my frist graylog installation.

Now I may be just a paranoid, but I noticed this in the output of lsof -i:

mytoy.localdomain:38238->ec2-52-17-197-100.eu-west-1.compute.amazonaws.com:https (CLOSE_WAIT)

And I kind of wonder what is this? Why would my graylog talk to some obscure aws machine?

Can someone please explain?

Many thanks,

Oren

don’t be paranoid… at least not about this… there are message processors and there is one that reached out to AWS for region lookups… They can be disabled. They are under System | Configurations.

1 Like

If you have disabled the AWS parts in System > Configuration that should be gone. But it might be that you have some lookup tables that does a lookup any other plugin running that gets data from the outside world.