Graylog inputs in VLAN

Graylog Central (peer support)
1

Hello, I’m new to this so please have patience with me :stuck_out_tongue:

I have Graylog server on VM running with two interfaces:
enp0s3 192.168.10.10
enp0s3.2 (vlan 2) 192.168.20.10
Hosts I want to monitor are in vlan 2, but server is running on enp0s3 interface.
I set http_bind_address and http_publish_uri to 192.168.10.10, because when it was set to 127.0.0.1 or 0.0.0.0 web interface wouldn’t load.
Pings from graylog reach vlan 2, but i can’t see any traffic with tcpdump. Inputs are running but I don’t recieve any messages.
How to make Graylog listen on vlan 2?
Thanks in advance, have a good day.

2

When you create an input you can set a bind addres for it wich defaults to 0.0.0.0
Does it help setting the address where you want to listen to (Edit Interface)?

3

I tried with bind address 0.0.0.0 and 192.168.20.10 but nothing changes, input running, no messages. I have snmp configured on 192.168.20.11, but when I try tcpdump port 161 on this address, I see nothing. It’s like I can ping 20.11 but there’s no other traffic.

4

The problem with snmp could be due tot system restrictions allowing nothing below port 1024.

Maybe this helps on that:

Could your vlan be the problem, try traceroute, mtr of telnet to the desired addres and port.

Is the server listening ont the configured port (netstat -an | grep 9200).

5

Hello @voust

Have you tried to use a bridge,

6

UPDATE

I see some traffic now, when i try tcpdump host 192.168.20.11 and port 1502 i get:

192.168.20.11.syslog > graylog.1502: [udp sum ok] SYSLOG, length: 240
Facility user (1), Severity debug (7)
Msg: Jul 29 12:59:08 192.168.20.11-1 SNTP[SNTP]: sntp_client.c(1900) 146536 %% SNTP: system clock synchronized on Fri Jul 29 12:59:08 2022 UTC. Indicates that SNTP has successfully synchronized the time of the box with the server (192.168.20.10).\0x00

But I still get no messages.
w
Any ideas?

7

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.