Hello, We have a single instance of Graylog . Currently the devices that are sending logs to our Graylog server are showing up by their hostname which is fine. But we are in middle of an investigation and need to find or co-relate hostname of a source with an ip-address. How can i find ip-address of the source that’s sending the message ? The source device in question are Windows 7/10 systems. Also, the device under investigation is a new windows system which has not been seen before & that is why we need to track down its ip.
Also is there a way to enable hostname & ip-address both in the messages for all sources ? Windows Event Viewer by default only has a system hostname written in events for it to forward to syslog server.
We have tried nslookup, ping etc but that device is no longer active on our network so we are relying on graylog for this.
Thanks Jan. That helps too. On a quick note, does graylog by default refer to an internal DNS server for populating hostnames of the sources to show in the Web UI or does it do that based off the content that it sees in the incoming logs from a device?
During our investigation , I was looking for ways to check internal DNS cache of the Graylog ubuntu VM but looks like nscd package is not installed so there wouldn’t be any dns cache created.