Using the iptables information from the FAQ,
It works great, but … if I list my iptables status (below), it shows very few packets being forwarded (i.e. 22 total),
Chain PREROUTING (policy ACCEPT 7601 packets, 1404K bytes) 2 22 4027 REDIRECT udp -- any any anywhere anywhere udp dpt:syslog redir ports 1514
However, if I look at Graylog - just the last 15 minutes shows 599 packets (through this rule). Has anyone else seen this? It’s like the udp packets are not being counted correctly for some reason.