# Graylog INPUTS fail **URL:** \ **Category:** Graylog Central (peer support)\ **Created:** [August 28, 2023, 4:10pm UTC](https://community.graylog.org/t/graylog-inputs-fail/29930 "2023-08-28T16:10:10Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![adrianrus](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/adrianrus/32/13048_2.png) [@adrianrus](https://community.graylog.org/u/adrianrus)\ **Post date:** [August 28, 2023, 4:10pm UTC](https://community.graylog.org/t/graylog-inputs-fail/29930/1 "2023-08-28T16:10:10Z")
Hi everyone INPUT fails to start. Graylog 5.0.9+f018089 with OpenSearch /etc/default/elasticsearch FILE looks like this: ```auto ################################ # OpenSearch ################################ # OpenSearch home directory #OPENSEARCH_HOME=/usr/share/opensearch # OpenSearch Java path OPENSEARCH_JAVA_HOME=/usr/lib/jvm/java-1.11.0-openjdk-amd64 # OpenSearch configuration directory # Note: this setting will be shared with command-line tools OPENSEARCH_PATH_CONF=/etc/opensearch # OpenSearch PID directory #PID_DIR=/var/run/opensearch # Additional Java OPTS #OPENSEARCH_JAVA_OPTS= # Configure restart on package upgrade (true, every other setting will lead to not restarting) #RESTART_ON_UPGRADE=true ################################ # OpenSearch service ################################ # SysV init.d # # The number of seconds to wait before checking if OpenSearch started successfully as a daemon process OPENSEARCH_STARTUP_SLEEP_TIME=5 ################################ # System properties ################################ # Specifies the maximum file descriptor number that can be opened by this process # When using Systemd, this setting is ignored and the LimitNOFILE defined in # /usr/lib/systemd/system/opensearch.service takes precedence #MAX_OPEN_FILES=65535 # The maximum number of bytes of memory that may be locked into RAM # Set to "unlimited" if you use the 'bootstrap.memory_lock: true' option # in opensearch.yml. # When using systemd, LimitMEMLOCK must be set in a unit file such as # /etc/systemd/system/opensearch.service.d/override.conf. #MAX_LOCKED_MEMORY=unlimited # Maximum number of VMA (Virtual Memory Areas) a process can own # When using Systemd, this setting is ignored and the 'vm.max_map_count' # property is set at boot time in /usr/lib/sysctl.d/opensearch.conf #MAX_MAP_COUNT=262144 ``` on a check looks okey ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/9/9f591374997a019809cb350d2eb028378659eb77.png) RSYSLOG: ```auto ################# #### MODULES #### ################# module(load="imuxsock") # provides support for local system logging #module(load="immark") # provides --MARK-- message capability # provides UDP syslog reception module(load="imudp") input(type="imudp" port="514") # provides TCP syslog reception module(load="imtcp") input(type="imtcp" port="514") # provides kernel logging support and enable non-kernel klog messages module(load="imklog" permitnonkernelfacility="on") ########################### #### GLOBAL DIRECTIVES #### ########################### # # Use traditional timestamp format. # To enable high precision timestamps, comment out the following line. # $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat # Filter duplicated messages $RepeatedMsgReduction on # # Set the default permissions for all log files. # $FileOwner syslog $FileGroup adm $FileCreateMode 0640 $DirCreateMode 0755 $Umask 0022 $PrivDropToUser syslog $PrivDropToGroup syslog # # Where to place spool and state files # $WorkDirectory /var/spool/rsyslog # # Include all config files in /etc/rsyslog.d/ # $IncludeConfig /etc/rsyslog.d/*.conf $IncludeConfig /etc/rsyslog.d/*.conf $template GRAYLOGRFC5424,"<%PRI%>%PROTOCOL-VERSION% %TIMESTAMP:::date-rfc3339% %HOSTNAME% %APP-NAME% %PROCID% %MSGID% %STRUCTURED-DATA% %msg%\n" *.* @10.13.200.8:1514;RSYSLOG_SyslogProtocol23Format ``` the INPUT setting ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/f/f3abaea00ed9ff6b0ffb0b315210baaebbee3a4b.png) the collector ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/d/dd4bc211b22ea6653c25ba0e9d19d831b0367361.png) got the: iptables -t nat -A PREROUTING -p tcp --dport 514 -j REDIRECT --to 1514 iptables -t nat -A PREROUTING -p udp --dport 514 -j REDIRECT --to 1514 as well i m still trying to understand why the input doesn t start ---
**Author:** ![drewmiranda-gl](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/drewmiranda-gl/32/13376_2.png) [@drewmiranda-gl](https://community.graylog.org/u/drewmiranda-gl)\ **Post date:** [August 28, 2023, 4:54pm UTC](https://community.graylog.org/t/graylog-inputs-fail/29930/2 "2023-08-28T16:54:07Z")
Can you post the text with the error directly from `server.log`? default location: `/var/log/graylog-server/server.log` Thanks! ---
**Author:** ![adrianrus](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/adrianrus/32/13048_2.png) [@adrianrus](https://community.graylog.org/u/adrianrus)\ **Post date:** [August 28, 2023, 8:25pm UTC](https://community.graylog.org/t/graylog-inputs-fail/29930/4 "2023-08-28T20:25:46Z")
``` subjectAltNames: [*.domainname.net, domainname.net] ``` 2023-08-01T13:10:01.700+02:00 WARN [ProxiedResource] Unable to call [https://10.13.200.8:9000/api/system/inputstates](https://10.13.200.8:9000/api/system/inputstates) on node \<82b9e79c-db07-45af-8a24-a6a9618fe37a\>: Hostname 10.13.200.8 not verified: certificate: sha256/uOlV5U3Iwdsx4bl0BGhunltQFex/zhayRxwMIUc7bSk= DN: CN=_.domainname.net subjectAltNames: [_.domainname.net, [domainname.net](http://domainname.net)] 2023-08-01T13:10:02.216+02:00 WARN [ProxiedResource] Unable to call [https://10.13.200.8:9000/api/system/metrics/multiple](https://10.13.200.8:9000/api/system/metrics/multiple) on node \<82b9e79c-db07-45af-8a24-a6a9618fe37a\>: Hostname 10.13.200.8 not verified: certificate: sha256/uOlV5U3Iwdsx4bl0BGhunltQFex/zhayRxwMIUc7bSk= DN: CN=_.domainname.net subjectAltNames: [_.domainname.net, [domainname.net](http://domainname.net)] 2023-08-01T13:10:03.704+02:00 WARN [ProxiedResource] Unable to call [https://10.13.200.8:9000/api/system/inputstates](https://10.13.200.8:9000/api/system/inputstates) on node \<82b9e79c-db07-45af-8a24-a6a9618fe37a\>: Hostname 10.13.200.8 not verified: certificate: sha256/uOlV5U3Iwdsx4bl0BGhunltQFex/zhayRxwMIUc7bSk= DN: CN=_.domainname.net subjectAltNames: [_.domainname.net, [domainname.net](http://domainname.net)] 2023-08-01T13:10:04.219+02:00 WARN [ProxiedResource] Unable to call [https://10.13.200.8:9000/api/system/metrics/multiple](https://10.13.200.8:9000/api/system/metrics/multiple) on node \<82b9e79c-db07-45af-8a24-a6a9618fe37a\>: Hostname 10.13.200.8 not verified: certificate: sha256/uOlV5U3Iwdsx4bl0BGhunltQFex/zhayRxwMIUc7bSk= DN: CN=_.domainname.net subjectAltNames: [_.domainname.net, [domainname.net](http://domainname.net)] 2023-08-01T13:10:05.706+02:00 WARN [ProxiedResource] Unable to call [https://10.13.200.8:9000/api/system/inputstates](https://10.13.200.8:9000/api/system/inputstates) on node \<82b9e79c-db07-45af-8a24-a6a9618fe37a\>: Hostname 10.13.200.8 not verified: certificate: sha256/uOlV5U3Iwdsx4bl0BGhunltQFex/zhayRxwMIUc7bSk= DN: CN=_.domainname.net subjectAltNames: [_.domainname.net, [domainname.net](http://domainname.net)] 2023-08-01T13:10:06.222+02:00 WARN [ProxiedResource] Unable to call [https://10.13.200.8:9000/api/system/metrics/multiple](https://10.13.200.8:9000/api/system/metrics/multiple) on node \<82b9e79c-db07-45af-8a24-a6a9618fe37a\>: Hostname 10.13.200.8 not verified: certificate: sha256/uOlV5U3Iwdsx4bl0BGhunltQFex/zhayRxwMIUc7bSk= DN: CN=_.domainname.net subjectAltNames: [_.domainname.net, [domainname.net](http://domainname.net)] 2023-08-01T13:10:07.710+02:00 WARN [ProxiedResource] Unable to call [https://10.13.200.8:9000/api/system/inputstates](https://10.13.200.8:9000/api/system/inputstates) on ^C ---
**Author:** ![joe.gross](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/joe.gross/32/13372_2.png) [@joe.gross](https://community.graylog.org/u/joe.gross)\ **Post date:** [August 28, 2023, 9:20pm UTC](https://community.graylog.org/t/graylog-inputs-fail/29930/5 "2023-08-28T21:20:49Z")
@adrianrus, it appears you haven’t configured your certificates correctly. Did you get it working without https first? If so, what changes did you make after that? ---
**Author:** ![adrianrus](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/adrianrus/32/13048_2.png) [@adrianrus](https://community.graylog.org/u/adrianrus)\ **Post date:** [August 29, 2023, 9:54am UTC](https://community.graylog.org/t/graylog-inputs-fail/29930/6 "2023-08-29T09:54:25Z")
thing is that i followed a cookbook created by … me still when did another server and working :))) BUT, that is on the 4.2 version with elastic search, this is 5.0 with opensearch and some things might be off. I might need to go for the non TLS version and start from there. ☹ ---
**Author:** ![joe.gross](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/joe.gross/32/13372_2.png) [@joe.gross](https://community.graylog.org/u/joe.gross)\ **Post date:** [August 29, 2023, 8:31pm UTC](https://community.graylog.org/t/graylog-inputs-fail/29930/7 "2023-08-29T20:31:14Z")
Beware of “should have”. It has led me astray more times than I care to admit. Establishing a known good configuration without TLS would be where I start and go from there. Good luck and let us know how it turns out! ---
**Author:** ![adrianrus](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/adrianrus/32/13048_2.png) [@adrianrus](https://community.graylog.org/u/adrianrus)\ **Post date:** [September 5, 2023, 10:19am UTC](https://community.graylog.org/t/graylog-inputs-fail/29930/8 "2023-09-05T10:19:39Z")
will do 🙂 keeping this one alive until then with update ---
**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\ **Post date:** [September 19, 2023, 10:20am UTC](https://community.graylog.org/t/graylog-inputs-fail/29930/9 "2023-09-19T10:20:02Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.