Issue received log from cyberoam syslog

[csamart (samart)]

I was setup log sending from cyberoam firewall but I cannot read log from cyberoam. Log was show as picture, I was test kiwi syslog are read find. please help.

Environment: Graylog server on Ubuntu 18.04

[jan (Jan Doberstein)]

how did you ingest messages? What Graylog version did you use exactly?

[csamart (samart)]

Thanks Jan for response, I ingest via send syslog to graylog as picture. Graylog v.3.1.2 and extractors is Graylog extractors for Spohos UTM 9 sendard syslog fields.

[csamart (samart)]

Input setup as picture

[csamart (samart)]

When show received messages as picture

[jan (Jan Doberstein)]

I do not know what format the logs are send from this device - but I guess that they are not following any standard? You might want to check how they look like when you send them to a RAW input…

[csamart (samart)]

When I send same log to Kiwi Syslog are find, I guest it may be configuration of Graylog or Ubuntu but I don’t know where to fix it.

[jan (Jan Doberstein)]

you might want to send them to a RAW input in Graylog to check if that can read it …

[csamart (samart)]

Raw/pain text result same as Syslog UDP.

[zoulja]

Can you grab some packets with tcpdump and show packet’s content?