No message sources found



I’m new to graylog and struggling to get it to work. I have created the below file on the server i wish to monitor


$template GRAYLOGRFC5424,"%protocol-version% %timestamp:::date-rfc3339% %HOSTNAME% %app-name% %procid% %msg%\n"

and created inputs for both tcp and udp as below as per instructions

SYSLOG TCP (Syslog TCP) 1 running
Network IO:  0B  0B (total:  1,8MiB  0B )  Show details
Total connections: 1 (1 active)  Show details
allow_override_date: true
port: 5140
recv_buffer_size: 1048576

SYSLOG UDP (Syslog UDP) 1 running
Network IO:  0B  0B (total:  1.9MiB  0B )  Show details
allow_override_date: true
port: 5514
recv_buffer_size: 1048576

When i click on sources there is nothing there. IP tables have been turned off on both servers.

Any ideas as to what ive missed or not done correctly?


(Jochen) #2

You’ve got it the wrong way round. In the rsyslog configuration, @ means UDP, @@ means TCP.

Please refer to for the relevant documentation.


Thanks, ive updated this and restarted the syslog service but im still not seeing anything?

(Jochen) #4

What did you change exactly and what’s the current configuration of your Graylog syslog inputs and rsyslog?



I just changed the 90-graylog2.conf file in rsyslog.d

$template GRAYLOGRFC5424,"%protocol-version% %timestamp:::date-rfc3339% %HOSTNAME% %app-name% %procid% %msg%\n"
*.* @@;GRAYLOGRFC5424
*.* @;GRAYLOGRFC5424

The gralog inputs are still the same

(Jochen) #6

Please use the RSYSLOG_SyslogProtocol23Format rsyslog template instead of your custom one (as described in and make sure that your machine running rsyslog is able to connect to the Graylog syslog inputs you’ve configured.



Thanks its working now.

I’m having some issues setting up the dashboard. The bar charts don’t seem to work, a refresh icon in the middle of the place holder flashes periodically.

I’m also unable to get a pie chart to display, i have selected quick values from the messages side bar. but all i get is a table with the percentage and count.