How to show local0 messages on graylog

I have been using graylog for a while, it has been working for some devices, but recently i wanted to add an aditional device is a cisco olt but no messages are being showned:

Here is the TCPDUMP:

18:34:04.380479 IP A.A.A.A.syslog > gserver.mydomain.syslog: SYSLOG, length: 96

On Graylog server i see nothing but on tcpdump it says it is receiving something.

I have done a tcpdump for an working IP and i am showing this:

18:35:48.313074 IP B.B.B.B.50265 > gserver.mydomain.syslog: SYSLOG local7.warning, length: 158

If I add a linux server it works fine, but A.A.A.A is not working at all.

What do I need to do for Showing local0 messages?

most likely either a timestamp issue or a input type issue, or both.

go to system | inputs | and click show received messages for the input you are having issues with. It will perform a search without a time frame, “All Messages”. If that returns something, take a look at the timestamp of the messages to see if the date/time is not being parsed correctly because Cisco is known for have non syslog standard syslog messages. If that is the case, you’ll probably need to change the input to RAWtext/UDP to see if that fixes it.

I have checked the timestamp, i have an NTP server.

I have set to Show all messages and search it on it, but nothing.

Ok, supposed that is the timestamp, the others logs work fine but what could modify the timestamp.

Anyway i set source:A.A.A.A on all messages and nothing is being shown.

Doing a parallel run of time on my CISCO OLT and graylog server i got:

#show clock
19:12:43 Fri Feb 26 2021 NI

Fri Feb 26 19:12:43 CST 2021

I will try to change the input to what you are saying, thanks, i will update You on any changes.

I have solved it thanks to you, i added a new input and with iptabless averything comming from non standard syslog i redirect it to the raw syslog udp all others to the standard udp input:

#For non Standard Inputs
iptables -t nat -A PREROUTING --source A.A.A.A -p udp --dport 514 -j REDIRECT --to 1515
iptables -t nat -A PREROUTING --source B.B.B.B -p udp --dport 514 -j REDIRECT --to 1515

#For Standard Syslog Inputs
iptables -t nat -A PREROUTING -p udp --dport 514 -j REDIRECT --to 1514

Glad I could help… good luck!

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.