I need help with connecting my firewalls to graylog

Graylog Central (peer support)
41

You don’t have to but it may generate a lot of logs

42

:+1: so far so good I guess :laughing:

43

nothing is showing could it be the port not open?

44

Do you have port 5044 opened on Graylog server?

45

let me double check, when I was running nmap earlier on my graylog server it the only port open was 9000 even though I added 5044

46

hey
you should check your logs like @Wine_Merchant mention earlier.

47

just enabled it and it worked thank you so much

48

So you have logs showing now?

49

that’s quite strange that it didnt work on the device that wasn’t hosting the vm server

50

image

1 Like
51

Ok so you have 30 more minute left of my time :laughing: goo job @NEW2GRAY

52

ok my other question since I was able to now get logs firewall logs from this computer, would it be the same thing for a windows server? also how can I get syslogs to show

53

Yes, All windows Operating systems have event viewer.

54

but why didn’t winlogbeat show on my other sidecars that I added? It randomly showed after I added the device that is currently hosting the graylog server on hyper-v

previously I was testing other test devices such as a test laptop/desktop

55

Not sure but I can tell you this.

FileBeat is really good for Linux,
Winlogbeat is really good for Windows system
Nxlog is good for Both but take some work to make it right

56

winlog beat captures all window logs or just firewall?

57

Winlogbeat capture Event View logs , this would be like FileBeat capture Linux /var/log

58

BUT in some cases where you would have some open source install on Windows perhaps FileBeat would be the way to go for that. With windows you have permission and ports that may need to be opened/configured. Windows Pro/home normally do but Windows Server may have restriction on what ports are opened so you would have to open them by creating a firewall policy

59

Ok and if I was to look at setting up syslog I can export those logs to the graylog server with GELF and need to open 12201 port?

60

Windows Syslog is Event Viewer, On Ubuntu syslog is the system log file.

/var/log/syslog

By default GL input syslog UDP or TCP is set for port 12201 , But you do not have to use that port, so long as its above port 1024. any port below 1024 is a privilege port meaning root. But that for another day just stay above port 1024 u should be good.