How to add new host to the graylog server?


(vinoth) #1

how to add new host to the graylog server ?


(Jochen) #2

Please elaborate on what you want to achieve.


(vinoth) #3

I wanted to add switch and router into the graylog serve how do i do that ?


(Jan Doberstein) #4

a little more details what your current setup is and what you want to add - maybe with a map or a meaningful description might help others to help you.


(vinoth) #5

i just trying to collect logs from my Network devices and i don’t know how to add my network devices to gray log server. Anyone can help much appreciated.


(vinoth) #6

i just trying to collect logs from my Network devices and i don’t know how to add my network devices to gray log server. Anyone can help much appreciated.

can you help me? any documents?


(Jochen) #7

See http://docs.graylog.org/en/2.3/pages/sending_data.html for some details.


(vinoth) #8

I added two nodes in graylog server it worked fine for me but when i am trying to add network devices i can’t receive any log from network devices and i added SNMP jar as well still i don’t get any output from switches.


(vinoth) #9

can someone help me on this?


(Jochen) #10

You need to be much more verbose on what you want to achieve, which steps you already took (in detail), and what you’re struggling with.


(vinoth) #11

I followed this forum to create SNMP Traps for Network Switch but I don’t receive any log to gray log.

I configured a Cisco router, switch to send its logs to my graylog server. I tested both the Raw/Plaintext and the Syslog UDP input but i am not receiving any logs. I checked the in/out msg/s but there is no traffic.
Even when I direct the logs to rsyslog it does not work.


(Jochen) #12

What’s the specific (and full) configuration of the SNMP input in Graylog and the SNMP configuration of your network devices?

What’s the specific (and full) configuration of the syslog input in Graylog and the syslog configuration of your network devices?


(vinoth) #13

Configuration in switch

#snmp-server community public RO

screen grab log configuration


(Jochen) #14

I think you’re missing some parameters here, e. g. the address of the target (“host-addr”).
https://www.cisco.com/c/en/us/support/docs/ip/simple-network-management-protocol-snmp/13506-snmp-traps.html

Has the SNMP input been started successfully?

What’s the output of the following command on the machine running Graylog?

netstat -tulpen

(vinoth) #15

Network switches have been configured in Nagios server and I am getting output which I am expecting Jochen :slight_smile:

netstat -tulpen

Port has not listened when I mention 162 ( it’s a default port 162 opened in SNMP service in switch )
but when I mention other port like 1620 in SNMP Traps I can see the port opened.

udp6 0 0 :::1620 :::* 1001 10184 -

Thanks in advance Mr.jochen


(vinoth) #16

Nagios are configured with SNMP port forget to mention in earlier message.


(Jochen) #17

http://docs.graylog.org/en/2.3/pages/faq.html#how-can-i-start-an-input-on-a-port-below-1024


(vinoth) #18

I really appreciate your help here but I got no luck. Still the same issue here I write down what are the steps I followed.

Step 1:
Downloaded SNMP plugin and placed in /opt/graylog/plugin folder and checked graylog.conf file whether the path is right.

Step 2 :
restarted gray-log server
command : graylog-server restart

Step 3 :

  Installed `snmp` and `snmp-mibs-downloader` packages

Step 4 :
In the Graylog web interface, System/Inputs and create a new SNMP input like this:

Saved.

Step 5 :

Firewall :

configured IP address and port to receive SNMP traps.

Step 6 :

Ip tables rules are configured in graylog server.

-A PREROUTING -p udp -m udp --dport 514 -j REDIRECT --to-ports 5140
-A PREROUTING -p tcp -m tcp --dport 514 -j REDIRECT --to-ports 5140

I don’t know where i missed. Kindly help :roll_eyes::disappointed_relieved:

Thanks in advance.


(vinoth) #19

Anyone can help me here :frowning: :frowning:


(Jochen) #20

Port 514/udp (and 514/tcp) is the well-known port for syslog, not SNMP (which is using 161/udp and 162/udp).