Hello everyone, I have a Graylog cluster and I use syslog or Sidecar to collect logs from switches and servers. However, I did not install Sidecar on the Graylog server and data nodes to collect Graylog’s own logs. Is there any good solution for this issue? I found a plugin called graylog-plugin-internal-logs, but it hasn’t been updated for a long time. Thank you!
Hello @baalkchina, in some small irony it’s not recommended that Graylog collect its own logs as there is potential to create a loop which will bring the cluster down. It’s better to use monitor the metrics output of the cluster via Prometheus and Grafana.
If you are hell bent on ingesting Graylog logs back into itself, then install sidecar and use filebeat to monitor the default logging locations found under /var/log/graylog-server/server.log and /var/log/graylog-datanode/datanode.log.
Thank you! A few days ago, I noticed some anomalies in my Graylog system (fortunately, it was due to NTP issues and they’ve been resolved). However, to troubleshoot these problems, I had to log in to the Linux shell and perform CLI operations. So I’m wondering if there is a simpler way to view Graylog logs directly from the Graylog web interface.
No worries @baalkchina. For a quick check of the most recent node logs you are also able to view them via the UI from the cluster config page and selecting more per Graylog node.
