# Graylog inputs do not seem to be working

**URL:** <https://community.graylog.org/t/graylog-inputs-do-not-seem-to-be-working/6421>\
**Category:** Graylog Central (peer support)\
**Created:** [August 14, 2018, 3:06pm UTC](https://community.graylog.org/t/graylog-inputs-do-not-seem-to-be-working/6421 "2018-08-14T15:06:30Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![sanepushkar](https://avatars.discourse-cdn.com/v4/letter/s/73ab20/32.png) [@sanepushkar](https://community.graylog.org/u/sanepushkar)\
**Post date:** [August 14, 2018, 3:06pm UTC](https://community.graylog.org/t/graylog-inputs-do-not-seem-to-be-working/6421/1 "2018-08-14T15:06:30Z")

</div>

Hi guys,

I am really new to Graylog. I have read a lot of the topics on this forum to look for an answer but couldn’t find one. I recently installed Graylog instance on Openstack for a project. I sent syslogs to this instance on port 514. Below are the screenshots of my inputs.  
I am also attaching configuration of my /etc/rsyslog.conf file.

![inputs](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/5/50101abb5847574e1904e308a6c968808943fa79.png) ![file_1](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/0/0385f96408023e4f666ad617ed15416c8090ab84.png)

 ![file_2](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/f/f22817f84af7e7ae2d597aa6765ec4f5efe8c393.png)

I have been at it for a while and haven’t been able to find any solutions. Please let me know if there is any information that I missed.

Netstat shows that Graylog is listening on port 514.

 ![netstat](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/a/a82e0e32b83afb36543f3cab9cbdcfb9be233ac1.png)

Also, tcpdump on the interface and port 514 does not show anything! Please help.

---

<div class="post-metadata">

**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\
**Post date:** [August 15, 2018, 8:54am UTC](https://community.graylog.org/t/graylog-inputs-do-not-seem-to-be-working/6421/2 "2018-08-15T08:54:10Z")

</div>

you have opened Port **4000** with UDP Syslog input in Graylog, but your rsyslog forward the messages to Port **514**.

Change rsyslog to forward to Port **4000** and you will receive messages. In addition you should not use TCP and UDP as forward - one is enough.

---

<div class="post-metadata">

**Author:** ![JonathanKayumbo](https://avatars.discourse-cdn.com/v4/letter/j/eb8c5e/32.png) [@JonathanKayumbo](https://community.graylog.org/u/JonathanKayumbo)\
**Post date:** [August 15, 2018, 8:59am UTC](https://community.graylog.org/t/graylog-inputs-do-not-seem-to-be-working/6421/3 "2018-08-15T08:59:50Z")

</div>

Hi Jan, i’m also very new to graylog… am able to receive some logs from server but i can not receive logs from other important servers,  
I can see messaghe from graylog that there is TCP/UDP block, can you please help out ! Please

I have attached the message i see on my graylog logs

![graylog](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/1/1ec65c2268d1923845c2677cd963a24a74d79595.png)

---

<div class="post-metadata">

**Author:** ![KuboMD](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/kubomd/32/2765_2.png) [@KuboMD](https://community.graylog.org/u/KuboMD)\
**Post date:** [August 15, 2018, 6:08pm UTC](https://community.graylog.org/t/graylog-inputs-do-not-seem-to-be-working/6421/4 "2018-08-15T18:08:15Z")

</div>

“DPT=1947” means it’s being blocked on that port. If it’s a message you want to receive you’ll need to allow access in ufw I believe

---

<div class="post-metadata">

**Author:** ![sanepushkar](https://avatars.discourse-cdn.com/v4/letter/s/73ab20/32.png) [@sanepushkar](https://community.graylog.org/u/sanepushkar)\
**Post date:** [August 24, 2018, 2:10pm UTC](https://community.graylog.org/t/graylog-inputs-do-not-seem-to-be-working/6421/5 "2018-08-24T14:10:18Z")

</div>

Thank you. It works great now. Such a silly mistake.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [September 7, 2018, 2:10pm UTC](https://community.graylog.org/t/graylog-inputs-do-not-seem-to-be-working/6421/6 "2018-09-07T14:10:23Z")

</div>

Closed on September 7, 2018, 2:10pm UTC

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.
