Description of your problem After rebooting the Graylog server no message are coming in or out. Description of steps you’ve taken to attempt to solve the issue I thought it might be a problem with iptables, but they are persistent after the reboot. ``` # Generated by iptables-save v1.6.1 on Wed Se…

[image] tmacgbay: assumes that FortiGate sends to Graylog on port 1415 or you are using something like iptables to route from whatever FortiGate is sending to (514 maybe?) over to port 1415 before Graylog receives it. That is correct. In the FortiGate UI I cannot change the port number. So I …

@tmacgbay @gsmith . I will keep you posted. However, it will be next week. My boss just pulled me off this, in order to figure out how to replicate our ldap server and add SSL. I think I’d rather work on Graylog!

Plugins are updated. @gsmith Two questions about your instructions. Where my data is stored seems to be one of the big problems here. Do I want to backup /var/lib/elasticsearch or should I backup /mnt/sdb/data and /mnt/sdb/logs where my data is actually being saved. In your instructions, I don’t …

Hello, [image] rrmike: Where my data is stored seems to be one of the big problems here. Do I want to backup /var/lib/elasticsearch or should I backup /mnt/sdb/data and /mnt/sdb/logs where my data is actually being saved. Good question, its hard for me to tell you but from what you stated I …

Keeping this ticket alive. Had to jump on some other projects!

We can go back to the Graylog server log - lets make sure we are addressing and fixing errors in there. If I recall correctly you were rolling back any changes if they did not fix the problem? We may have multiple issues going. The odd thing we found was you moved elasticsearch to store data on …

[image] tmacgbay: To your question about rebuilding and moving data from your old server to the new - I have never tried that Yeah, let’s not do that! [image] tmacgbay: To the single/split drives… either would work since it is just as easy to grow drives in a virtual environment Makes…

sudo tail -f /var/log/elasticsearch/gc.log [2021-12-29T19:15:26.362+0000][17977][gc,heap ] GC(56) Eden regions: 579->0(588) [2021-12-29T19:15:26.362+0000][17977][gc,heap ] GC(56) Survivor regions: 19->12(75) [2021-12-29T19:15:26.362+0000][17977][gc,heap ] GC(56) Old regions: 101->101 [20…

[image] rrmike: Do you notice the time stamps? Why does /var/log/elasticsearch/gc.log think it’s 2021-12-29T19:15:33.816 ? That does not seem right. I’m on Eastern Time, it’s 14:43 right now. I am pretty sure that is just logging in UTC. Can you give the graylog serverlog from startup after …

[image] tmacgbay: I am pretty sure that is just logging in UTC. That makes sense. [image] tmacgbay: Can you give the graylog serverlog from startup after reboot? As in, reboot, stop the graylog service, set the tail, then start graylog and post the log results? Here they are. sudo ta…

Lets focus on the raw input for fortigate. We should see something there. double check all simple things, make sure the port is matching the expected port of data from fortigate. You can watch the port to make sure it sees traffic coming in (there are commands in the community you can research o…

No Messages In or Out after rebooting Graylog Server

Graylog Central (peer support)

gsmith (GSmith) January 4, 2022, 11:11pm 49

Glad you fixed your issue BTW I seen this in the forum.

Topic		Replies	Views
Graylog want start Graylog Central (peer support)	10	2569	August 1, 2018
Unable to get graylog started Graylog Central (peer support) basic-configuration	5	3356	February 1, 2022
GRAYLOG 2.5 server currently unavailable Graylog Central (peer support)	7	1432	January 2, 2020
Graylog Big Problem Graylog Central (peer support) access-specific-log-	26	4402	December 5, 2022
Graylog is restarting... Graylog Central (peer support)	4	2182	March 27, 2018

No Messages In or Out after rebooting Graylog Server

Related topics