How to use Dell SonicWall Firewall?


(Tran Tien Dung) #1

I just install this plugin in graylog marketplace: https://marketplace.graylog.org/addons/499f432f-bca2-4bfe-b973-fd027fba787a,


Seen like graylog receive logs, but I click “Show Received messages”, it said “nothing found”, please advise me how to fix it.
Thanks.


(Jochen) #2

Have you configured your Dell SonicWall Firewall accordingly?
Also try using an “Absolute Search” in Graylog and setting the end date some hours into the future to rule out problems with timestamps/timezones.


(Tran Tien Dung) #3

Hi Jochen,
Strange, now I see it. I let default search in last 8 hours, totaly same what i did yesterday. I thinks it would be ok right now.
Thanks.


(Jochen) #4

This means that the timestamps of your messages have the wrong timezone.

You can use the parse_date() function or a Copy Input extractor with a Date converter to change it to the correct timezone.


(Tran Tien Dung) #5

where can I put parse_date() function into. I just figure out that it get incorrect time

. in my picuture I search log in 15PM, but the latest message just 13PM.


(Jochen) #6

parse_date() is a processing pipeline function: http://docs.graylog.org/en/2.3/pages/pipelines.html


(Tran Tien Dung) #7

Seen like my graylog server get log slow, it alway get logs 2 hours ago, does it related this function?


(Jochen) #8

It’s not slow, it’s simply the timestamps/timezones of the messages.


(Tran Tien Dung) #9

Thanks Jochen, I tried with Copy Input extractor, but not success, i will create another thread about this issue.


(system) #10

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.