I currently have two issues.
- MongoDB is running on docker and communicating with my graylog instance. Local machine.
When I reboot, I lose all my inputs and my mongodb docker just keeps growing in size.
2.This is the more serious issue.
I have OSSEC running and forwarding messages to Graylog.
I’ve setup my CEF input and the metrics show as follow:
1 minute avg:
5 minute avg:
15 minute avg:
This means that we are indeed receiving data? Yet when I try to search for the messages on graylog there is nothing.
When I look at the Disk Journal Utilization:
0 unprocessed messages are currently in the journal, in 1 segments.
0 messages have been appended in the last second, 0 messages have been read in the last second.
Index set config shows:
graylog_0 active write index Contains messages up to a few seconds go (272.8KB / 95 messages)
How do I even start debugging this?