Graylog + Netscaler Loadbalancer

Graylog Central (peer support)
1

Graylog Version Graylog 2.5.2+4f6d123
OS SLES12 SP4
IP Graylog Server 10.200.150.8 | DNS servername.company.de

Hey,
i have some trouble here with graylog and forwarding the webinterface using a load balancer
Due to a new company policy, web applications should no longer be addressed with the server name but with a readable name.
In this case servername.company.de:9000 should syslog.company.de. We use Citrix Netscaler for the redirection.
According to the responsible administrator, the Netscaler makes an SSL offload to redirect the request.
With other applications the redirection works without problem

I have made the following changes to the Config:

rest_listen_uri = http://servername.company.de:9000/api/
rest_transport_uri = http://servername.company.de:9000/api/
web_listen_uri = http://servername.company.de:9000/
web_endpoint_uri = https://syslog.company.de:9000/api/

However I always get the error message [see below] when I try to connect to the web interface at syslog.company.de or syslog.company:9000 or syslog.company.de:9000/api/.
At the same time I can call the webinterface under servername.company.de:9000 without any problems.
I also tried, as described in the documentation, to set rest_listen_uri and web_listen_uri to 127.0.0.1 and set the web_endpoint_uri to
syslog.company.de:9000/api/. Even with that it doesn’t work. In addition I have also entered the IP instead of the server name. Also this brought no change.

Do any of you have any idea what the configuration should be in order for the redirection to work?

Cheers
Jonas

Request has been terminated
Possible causes: the network is offline, 
Origin is not allowed by Access-Control-Allow-Origin, 
the page is being unloaded, etc.
Original Request
GET http://syslog.company.de:9000/api/system/sessions
Status code
undefined
Full error message
Error: Request has been terminated
Possible causes: the network is offline, 
Origin is not allowed by Access-Control-Allow-Origin, 
the page is being unloaded,

Foto_zur_Frage_bearbeitet
Foto_zur_Frage_bearbeitet.png666×565 77.7 KB

2

Ofource you have 1 node that has is_master = true in the config file.
I have this as default:
# Default: http://$http_bind_address/
#http_publish_uri = http://192.168.1.1:9000/

Set the http_external_uri = http://syslog.company.de/

I dont have the rest_ or web_ settings in my config file.

3

Hey,

Yes, only one Node and is set “is_master = true”

Okay thanks. But was is http://$http_bind_address? Does the specification refer to another specification?
The dollar sign indicates this.

You are using Graylog version 3.0 or higher. Many things have been renamed.

Cheers

4

htpp_publish url is not set so it falls back to default which you dont have to set in 3.0 at least. IUt just uses the bind address which is set earlier in the config.

5

the question is, how did you configure the loadbalancer?

What port does the loadbalancer listen with SSL to forward the request to Graylog? Is that Port 9000?

Your browser needs to be able to reach the Graylog API via the configured web_endpoint_uri when that is not possible you should check the configuration on that.

6

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.