Linux RedHat - NXLog

[AndreasD]

Hey Guys,

Please take a look on my nxlog.conf on my Linux Redhat VM.

########################################
# Global directives                    #
########################################
User nxlog
Group nxlog

LogFile /var/log/nxlog/nxlog.log
LogLevel INFO

########################################
# Modules                              #
########################################
<Extension gelf>
    Module      xm_gelf
</Extension>

<Input in>
        Module  im_file
        File    "/var/log/messages"
</Input>

<Output out>
    Module      om_tcp
    Host        172.20.42.15
    Port        12201
    OutputType  GELF_TCP
</Output>

########################################
# Routes                               #
########################################
<Route 1>
    Path        in => out
</Route>

I am trying to push log messages to my logserver via GELF_TCP. In my Input nothing is shown…
Thanks for you help.

[jochen]

Is the user “nxlog” or the group “nxlog” allowed to read from /var/log/messages?
Is there a GELF TCP input running in Graylog?
Is 172.20.42.15 the correct IP address and is 12201 the correct port of said GELF TCP input?

And last but not least, why use NXLOG and not the system’s syslog daemon to forward messages to Graylog?

Graylog2/graylog-guide-syslog-linux

[AndreasD]

Hello Jochen,

thanks for your reply.
Can I also use my own user?
Yes I do also habe a TCP_GELF Input!
IP and Port also correct!

Can the syslog deamon send messages to var/log/messages and to my graylog server? Or is it either or?

Thanks

[jochen]

@AndreasD

Can I also use my own user?

You can do whatever you want on your systems.

@AndreasD

Can the syslog deamon send messages to var/log/messages and to my graylog server? Or is it either or?

You let the syslog daemon write log messages to both destinations.

[AndreasD]

I have another Question.
I tried to install the rpm packed but It always tells me missing dependencies:

How can I finish my installation? What can I do?

[jochen]

You have to install the missing package(s) or use a statically linked version of NXLOG.

[AndreasD]

Where can I find the right ones, their are so many different!? Sorry but I am new to Linux and to Graylog.

[jochen]

How exactly have you tried installing NXLOG on your system?

Also take a look at the Collector Sidecar, which helps you setting up and configuring various third party log shippers (such as NXLOG or Filebeat).
http://docs.graylog.org/en/2.4/pages/collector_sidecar.html

[AndreasD]

Hello Jochen,

thanks for your help, now the NXLog is up and running. It is sending log messages to my graylog server!

I was asking myself how i can read a hole line of my “message.log” with nxlog to my graylog server! Where can I configure all the parameters and how do the grok pattern work with all that topic?!

I don´t see the connections between nxlog parsing and the graylog recieving message.

Thanks