# No sign of logs being in the graylog server **URL:** \ **Category:** Graylog Central (peer support)\ **Created:** [October 3, 2017, 3:02am UTC](https://community.graylog.org/t/no-sign-of-logs-being-in-the-graylog-server/2662 "2017-10-03T03:02:11Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![gzcwnk](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gzcwnk/32/972_2.png) [@gzcwnk](https://community.graylog.org/u/gzcwnk)\ **Post date:** [October 3, 2017, 3:02am UTC](https://community.graylog.org/t/no-sign-of-logs-being-in-the-graylog-server/2662/1 "2017-10-03T03:02:11Z")
I can see my rsyslog client is sending logs to the graylog2 server (docker setup), but I cant seem to see any sign graylog is seeing any logs what so ever. Searching for “ERROR” produces no results. Firewall rules look ok? ```auto root@ubuntu16-host1:/etc/sysctl.d# iptables -L -n Chain INPUT (policy ACCEPT) target prot opt source destination Chain FORWARD (policy DROP) target prot opt source destination CATTLE_FORWARD all -- 0.0.0.0/0 0.0.0.0/0 DOCKER-USER all -- 0.0.0.0/0 0.0.0.0/0 DOCKER-ISOLATION all -- 0.0.0.0/0 0.0.0.0/0 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED DOCKER all -- 0.0.0.0/0 0.0.0.0/0 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 Chain OUTPUT (policy ACCEPT) target prot opt source destination Chain CATTLE_FORWARD (1 references) target prot opt source destination ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 mark match 0x1068 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 mark match 0x4000 Chain DOCKER (1 references) target prot opt source destination ACCEPT tcp -- 0.0.0.0/0 172.17.0.5 tcp dpt:12201 ACCEPT tcp -- 0.0.0.0/0 172.17.0.5 tcp dpt:9000 ACCEPT tcp -- 0.0.0.0/0 172.17.0.5 tcp dpt:514 Chain DOCKER-ISOLATION (1 references) target prot opt source destination RETURN all -- 0.0.0.0/0 0.0.0.0/0 Chain DOCKER-USER (1 references) target prot opt source destination RETURN all -- 0.0.0.0/0 0.0.0.0/0 root@ubuntu16-host1:/etc/sysctl.d# ``` Where do I look next? ---
**Author:** ![gzcwnk](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gzcwnk/32/972_2.png) [@gzcwnk](https://community.graylog.org/u/gzcwnk)\ **Post date:** [October 3, 2017, 3:05am UTC](https://community.graylog.org/t/no-sign-of-logs-being-in-the-graylog-server/2662/2 "2017-10-03T03:05:08Z")
I followed the quickstart guide as follows, ```auto $ docker run --name mongo -d mongo:3 $ docker run --name elasticsearch \ -e "http.host=0.0.0.0" -e "xpack.security.enabled=false" \ -d docker.elastic.co/elasticsearch/elasticsearch:5.5.1 $ docker run --link mongo --link elasticsearch \ -p 9000:9000 -p 12201:12201 -p 514:514 \ -e GRAYLOG_WEB_ENDPOINT_URI="http://127.0.0.1:9000/api" \ -d graylog/graylog:2.3.0-1 ``` ---
**Author:** ![gzcwnk](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gzcwnk/32/972_2.png) [@gzcwnk](https://community.graylog.org/u/gzcwnk)\ **Post date:** [October 3, 2017, 3:21am UTC](https://community.graylog.org/t/no-sign-of-logs-being-in-the-graylog-server/2662/3 "2017-10-03T03:21:30Z")
I think the setup is only listening on ipv6? ```auto root@ubuntu16-host1:/etc/sysctl.d# netstat -peanut |grep 514 tcp6 0 0 :::514 :::* LISTEN 0 31990 4812/docker-proxy root@ubuntu16-host1:/etc/sysctl.d# ``` ? ---
**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\ **Post date:** [October 3, 2017, 8:08am UTC](https://community.graylog.org/t/no-sign-of-logs-being-in-the-graylog-server/2662/4 "2017-10-03T08:08:35Z")
What’s the configuration of rsyslog? What’s the configuration of the Syslog input in Graylog? ---
**Author:** ![gzcwnk](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gzcwnk/32/972_2.png) [@gzcwnk](https://community.graylog.org/u/gzcwnk)\ **Post date:** [October 4, 2017, 7:50pm UTC](https://community.graylog.org/t/no-sign-of-logs-being-in-the-graylog-server/2662/5 "2017-10-04T19:50:46Z")
rsyslog is unaltered except for sending to remote host on last line via tcp. The client is sending I can see it doing so in iptraf-ng. ---
**Author:** ![gzcwnk](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gzcwnk/32/972_2.png) [@gzcwnk](https://community.graylog.org/u/gzcwnk)\ **Post date:** [October 4, 2017, 7:53pm UTC](https://community.graylog.org/t/no-sign-of-logs-being-in-the-graylog-server/2662/6 "2017-10-04T19:53:19Z")
No idea on what’s configured in syslog input, its as installed. Nothing in the quickstart guide to say I need to do anything I can see. ---
**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\ **Post date:** [October 5, 2017, 7:35am UTC](https://community.graylog.org/t/no-sign-of-logs-being-in-the-graylog-server/2662/7 "2017-10-05T07:35:50Z")
@gzcwnk Please post the complete configurations I’ve asked for and don’t just describe them. ---
**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\ **Post date:** [October 19, 2017, 7:36am UTC](https://community.graylog.org/t/no-sign-of-logs-being-in-the-graylog-server/2662/8 "2017-10-19T07:36:02Z")
Closed on October 19, 2017, 7:36am UTC This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.