Mikrotik logi TCP problem

Graylog Central (peer support)
5

First off, Google Translate to the rescue: Dzień dobry! Rozumiem, że jest to niewygodne, ale zasady na forum mówią, że musimy pisać po angielsku.

Right… I will try to summarize:

  • You have two Syslog-type inputs defined, one TCP, one UDP.
  • The Mikrotik boxen aren configured to send their syslogs to either of these.
  • The MT logs arrive correctly at the UDP one, not at the TCP one.

This will come down to basic troubleshooting again… Unfortunately your screenshot does not show the config of both inputs, so we can’t easily compare them. So… basics, basics, basics…

  1. Configure one of your MT boxen to send TCP syslogs to the Graylog host, port 30000.
  2. On the Graylog host, use netstat to verify that the input is listening on 30000.
  3. On the Graylog host, check the firewall to see that the port is open for TCP.
  4. On the MT, test if you can connect to port 30000 on the Graylog host.
  5. Heck, pick another Linux host and try to send random data to the Graylog host, port 30000, using netcat.
  6. If log data is not arriving from the MT, run a Wireshark to see whether you even see network traffic going from the MT to Graylog.

And so on…

1 Like