I have graylog 4.X on ubuntu 20. I don’t have problem to read any ubuntu, debian server log on graylog. But i create sidecar for windows 10 and nxlog for windows 2012. All input is running (green) but server not received messages from windows. I don’t have a firewall on ubuntu and special port f…

Hello Looks like your missing parts of your Nxlog configuration file. The closing of Outputs and your Route This is incorrect. [image] Sharzad: <Output graylog> Module om_udp Host my-ip Port 12201 OutputType GELF Exec $short_message = $raw_event; It should be …

Hello, I might be able to help but your nxlog configuration is hard to read. it needs to be formatted like this. [image] From what I understand is that your Linux devices are good but your Windows server/s using nxlog is not. Did you check your nxlog log file for errors? Did you execute a tcp…

sorry i am new here. i find out what the problem is it was firewall between to subnet now i can see my graylog take row when i look under system/input it show total 10 MB. But when i say show received messages graylog show nothing. nxlog say running and no error how to send conf file conf file ha…

You’re sending syslog messages over UDP to Graylog, which is listening on 12201, is that right? If so, 12201 isn’t a default syslog port, nor is it something that we typically recommend setting syslog ports to. That’s the default port for GELF, so you should probably change your port to whatever you…

Hello, I concur with @aaronsachs perhaps changing you Port from12201 to something like 5140 and see if that helps. [image] Sharzad: Exec to_syslog_bsd(); Can I ask why your using to_syslog_bsd?

why port should be an issue. by the way, it was what graylog 4 suggested.

i have data on this server [image] but when i say show received messages i don’t have any entry. I don’t undrestand why port should be changed. ?

Hi there, not to be terse, but neither [image] Sharzad: why port should be an issue. by the way, it was what graylog 4 suggested. Nor [image] Sharzad: i have data on this server Tell me anything at all. Can you point me to where you got the config for NXlog? Can you also provide a fu…

i have an ubuntu 20.04 with utc time (which is 2 hours diff with windows) [image]

That still doesn’t tell me anything–it shows the config of the output. Can you try something like this: [CleanShot 2021-10-26 at 09.14.51] The gist of what I’m getting at is you’re sending syslog messages to a GELF input–that won’t work. At least that’s what I’m inferring from the port number you…

i do not change the port graylog suggested. it send entry and i can see input. when i try show received messages. it’s nothing to show.

Nxlog on windows 2012 not working

Graylog Central (peer support)

gsmith (GSmith) October 27, 2021, 9:31pm 14

@Sharzad

Sir,
This is really, really hard to help you. Please re-read @aaronsachs posts and mine above. I have no idea what I’m seeing.
Your Nxlog configuration is incorrect. Please read over this post.

Topic		Replies	Views
Collecting Windows Logs with NXLOG Graylog Central (peer support) sidecar , nxlog , nodatanx	3	6829	April 2, 2019
Setup of Graylog and NXLog Graylog Central (peer support) nxlog	13	4799	January 13, 2023
Nxlog event consistency Graylog Central (peer support) sidecar , windows , nxlog , docker	8	856	July 26, 2023
Graylog sidecar with nxlog Graylog Central (peer support) sidecar , nxlog , nodatanx	4	3024	April 24, 2019
Graylog not receive information from windows Graylog Central (peer support) sidecar , nxlog , nodatanx	1	619	November 14, 2018

Nxlog on windows 2012 not working

Related topics