Logs received too late but with the right timestamp

Graylog Central (peer support)
, , ,
9

Hello

To sum it up.

  • You have no extractors running that is manipulating the data from the input?
  • All buffers are 0 so there is no delay in processing data?
  • Checked your remote devices and they have the correct TimeZone and the Date/Time is also correct?
  • Graylog server Date/Time is correct which matches the remote device, correct?
  • The user logged on have the same Time/Zone and the date/Time is correct?
  • Did you double check your NTP service and configuration?
  • Did you see anything that may pertain to this issue in the log files?

Example:

image

What I noticed was this.

and this

So you have Linux and Windows going to the same INPUT/ports?
Have you tried to separate them?

Example Linux Servers.

image

Example Windows Servers

image

It might not help, but its worth a try. If anything, maybe we can narrow it down.

If you tried and checked our suggestions perhaps something in this post may help.

2 Likes