I get a log For Device system Alerts received message but No results on search page Help Me

Graylog Central (peer support)
2

Normal behavour if you have problem with timestamps.

  1. Check your device and graylog uses NTP synchronized time
  2. Check that you use correct timezone in device
  3. Check that you use correct timezone in Linux in graylog box
    Run command timedatectl and check fields Timezone and Local Time, Timezone should be your real timezone, and Local Time should be your actual time.
  4. If you don’t have correct timezone in graylog box chage it:
    Run command sudo timedatectl set-timezone "Europe/Bratislava" after that reboot graylog box (Change "Europe/Bratislava" to your real timezone)
  5. If you login to graylog web interface with user admin, check correct timezone in server.conf (It can’t be updated in web interface for user admin):
    sudo vim /etc/graylog/server/server.conf
    Find line root_timezone =
    and change it to your real timezone, for example root_timezone = Europe/Bratislava
    After that reboot graylog service using command: sudo systemctl restart graylog-server
  6. If everything is correct (points 1-5), check logs in System - Input and click Show messages
  7. Fortigate uses 2 separate field to setup date and time, use can use this pipeline rule to fix it:
rule "fortigate_timestamp"
when
  has_field("devname") AND has_field("date") AND has_field("time")
then
    let build_message_0 = concat(to_string($message.date), " ");
    let build_message_1 = concat(build_message_0, to_string($message.time));
    let new_time = parse_date(value: build_message_1, pattern:"yyyy-MM-dd HH:mm:ss", timezone:"Europe/Bratislava");
    set_field("timestamp", new_time);
end

Hope this helps.

1 Like