Hi,
Using the iptables information from the FAQ,
https://docs.graylog.org/en/3.2/pages/faq.html#how-can-i-start-an-input-on-a-port-below-1024
It works great, but … if I list my iptables status (below), it shows very few packets being forwarded (i.e. 22 total),
Chain PREROUTING (policy ACCEPT 7601 packets, 1404K bytes)
2 22 4027 REDIRECT udp -- any any anywhere anywhere udp dpt:syslog redir ports 1514
However, if I look at Graylog - just the last 15 minutes shows 599 packets (through this rule). Has anyone else seen this? It’s like the udp packets are not being counted correctly for some reason.
Thanks!