Nginx error log delay

Graylog Central (peer support)
1

The timezone set on graylog server and client is same.

And still, the logs generating in client nGinx error log file is getting delayed by around 1 hour. I mean on graylog server it shows 1 hour before nGinx error log generated even after starting auto refrest interval.

2

is this one hour before your local difference to UTC? What is the Timezone you have configured in your Graylog users profile?

3

User timezone is same as graylog server timezone.

4

How are you ingesting the nginx log files?
What’s the content of the nginx log file?

5

We have created seperate Input in graylog server on different port other then syslog.

It contains error which are generated in PHP.

6

the question is more:

  • how did you transport the messages from your message generating server to graylog?
  • how does a sample line look like?
7

I am using nGinx content pack from https://marketplace.graylog.org/addons/572ff823-62cc-468e-af17-300bcfd9932d

Timezone set on Graylog server, Graylog server user and client server is same. As you can check in below images.

Timezone
timezone

Graylog node timezone
node-timezone


Sample line

ss
ss.png1178×384 115 KB

I hope above details help in figuring out the cause of the problem.

8
  • what is the timezone of your client?
  • does the log timestamp contain timezone information?
9

Client timezone is Europe/Berlin (CET, +0100) which is same as Graylog server timezone.
Log contains local time which is server time. As you can check in Sample line image attached in previous reply.

10

the timestamp in the provided log does not contain a timestamp.

All messages that did not have a timezone information will be handled like UTC.

11

Any idea how to add timezone in nginx access and error logs?

12

You can use the processing pipeline for that, e. g. construct a date with the desired timezone:

13

I have select the timezone ‘Berlin’ from nginx error log input extractor from gaylog > System/Inputs Inputs and the logs from client is getting imported into graylog without any delay.

Isn’t it should pick timezone automatically based on graylog server or graylog user timezone?

14

No. It’s intentionally using UTC if no timezone was specified in the log message itself.

Food for thought: Yeller - The Worst Server Setup Mistake You Can Make

15

So the timezone which I have selected from nginx error logs input extractor is correct or not?

I also noticed that after changing the timezone some error logs are not getting imported to graylog server.

16

How should we know? You didn’t provide any details.