Lab graylog on ubuntu 22.04, could not send log from windows 10 and windows server to graylog

Graylog Labs
1

Hello
The installation of Graylog on the Ubuntu server is done and I can access the web interface via my Windows host, I used a docker image for the installation. I also proceeded to install nxlog on my windows server vm to collect its logs and send them to Graylog (in a scenario of access attempt, incorrect password) but it fails every time, ubuntu server (Graylog) is installed on a 2nd computer and the windows server and Kali linux vms on my main computer, to save resources, the vm network is configured as a bridge and all the machines are connected, the ping commands work between each machine. I first tried to ping ubuntu server from windows server and the ping is a success, and I also disabled the windows host and windows server firewalls and the ubuntu server firewall, configured the “.conf” file of nxlog to send the logs to graylog, and use the default port 12201 and check the port listens on the graylog server. The ping commands being successful but only use the ICMP protocol, I tested telnet from my windows server to ubuntu server, but it failed, and telnet from my windows host to ubuntu server again failed, yet the Test-NetConnection commands from the windows host and server work. ubuntu server IP address (graylog): 192.168.1.151
Windows server (vm) IP address: 192.168.1.122
Kali linux IP address (vm): 192.168.1.158
Windows host IP address: 192.168.1.179

I’m stuck, need help please.
Thanks

2

Does your docker config expose the ports needed by nxlog to send messages?

Something like : docker-compose/open-core/docker-compose.yml at e128f0f8c288eea1a07239a5b2fbae02d2afb5c9 · Graylog2/docker-compose · GitHub

3

Thank you for your advice, but i already remove it, and install another docker-compose. Everything goes well, but i’m stuck with the sending email option. i’ve started with graylog for 1week now
Here is my docker-compose.yml :

  - GRAYLOG_HTTP_EXTERNAL_URI=http://192.168.1.151:9000/
  - GRAYLOG_TRANSPORT_EMAIL_PROTOCOL=smtp
  - GRAYLOG_TRANSPORT_EMAIL_WEB_INTERFACE_URL=http://192.168.1.151:9000/
  - GRAYLOG_TRANSPORT_EMAIL_HOSTNAME=192.168.1.151
  - GRAYLOG_TRANSPORT_EMAIL_ENABLED=true
  - GRAYLOG_TRANSPORT_EMAIL_PORT=25
  - GRAYLOG_TRANSPORT_EMAIL_USE_AUTH=false
  - GRAYLOG_TRANSPORT_EMAIL_USE_TLS=false
  - GRAYLOG_TRANSPORT_EMAIL_USE_SSL=false
  - GRAYLOG_TRANSPORT_FROM_EMAIL=root@localhost
  - GRAYLOG_TRANSPORT_SUBJECT_PREFIX=[graylog]
depends_on:
  - mongo
  - elasticsearch
ports:
  - "9000:9000"
  - "12201:12201/udp"
  - "12202:12202"
volumes:
  - /etc/timezone:/etc/timezone:ro
  - /etc/localtime:/etc/localtime:ro
networks:
  - graylog

networks:
graylog:

i don’t know where is the issue.
Thanks

4

@Chadli Do you have a mail server setup already?

5

yes, i already fixed it with Postfix on ubuntu 22.04. Thank you