Hello everyone I’d just like to start seeing the logs from the graylog server itself. However I tried to change the syslog configuration there is no “connection enabled” on my input So I let the default config of rsyslog.conf thank you in advance

If you use Selinux, try to disable it (set to Permissive), restart rsyslog. Maybe Selinux is blocking connection.

[image] Questions and You: A guide to getting an answer Graylog Central (peer support) Hi folks, Lately it seems that questions are being asked which have been answered already, either on the forum, in the documentation, or with 5 minutes of Googling. Please keep in mind …

@Ponet I arleady search on google and on the forum, but I didn’t find the solution. Here’s I have all my service (graylog, elasticsearch, mongo, rsyslog) that work noramlly, and I did the firewall rules, tcp and udp modules are uncomment in rsyslog.conf I didn’t see the same thing other hand in …

In the graylog-server/server.log I found this: [image] But I don’t now if there is a link with my problem

NO it’s not a problem, it’s general info that you should see in all graylog instances. How did you configure rsyslog? please post

Hi @shoothub , Here’s the configuration of rsyslog.conf: [image] [image] The last ip is the one of the local server (graylog and syslog)

Why you try to send syslog messages to port 514, where rsyslog is listening? It doesn’t make sense. Try to use recommended steps: Create Syslog Input with port higher than 1024 e.g. 1514, TCP or UDP If you created UDP Syslog Input replace last line with: *.* @10.15.20.138:1514;RSYSLOG_SyslogProt…

Thank you @shoothub I try to send syslog messages to port 514 and not to port 1514 becayse rsyslog show mistake when I configure rsyslog to port 1514: [image] That’s why I send to port 514, so I created a firwall rule to translate: [image] And even when I do what you tell me to do just before,…

I don’t have good experience with port 514 translation, I would recommend to use ports higher than 1024, because graylog runs a normal user, and couldn’t listen lower port than 1024. You mixed 2 things. You’ve setup rsyslog to listen on port 514 and and to send to it? If you want to only forward l…

That’s what I did in my first try. Everything was supposed to be in 1514 port. I tried to do what you did, and comment all the line with 514. There’s still only this line: [image] But there’s still the same problem, no active connections and all the errors messages with systemctl status rsyslog …

It’s good, I have an active connexion, no log for now, but that’s an other thing. Thanks a lot!

Input - no active connection

Graylog Central (peer support)

Ponet (Jesse Hills) October 27, 2020, 4:11pm 2

Topic		Replies	Views
Send syslog from other linux to graylog server Development	9	1687	April 18, 2024
Join Graylog and Rsyslog Graylog Central (peer support)	5	807	October 10, 2018
Send data with rsyslog Graylog Central (peer support)	6	4596	August 20, 2019
Can't send rsyslog Graylog Central (peer support)	13	3084	August 26, 2017
Graylog inputs do not seem to be working Graylog Central (peer support)	4	3317	August 24, 2018

Input - no active connection

Related topics