Raw UDP input - not showing

Graylog Central (peer support)
1

Hi All,
I’m currently testing Greylog before installing to production. Goal is to get Greylog to store our RADIUS logs.

Steps done.
I downloaded the OVA - ran update
launched web portal - no issues.
created RAW/UDP input and tested using netcat
echo "Hello" | nc -u -w 1 x.x.x.x 1646

This is being recorded in Greylog - ace

Sending test Radius Data - I took a tcpdump of live data and used bittwist to edit the source and destination IP and then sent this on to my Greylog VM.
Running tcpdump, I could see the packets on port 1646 but nothing is appearing in the received messages.

I can also see that greylog is listening on port 1646

what am i missing? my only thoughts are the timestamps??
Mark

2

Yes, usually it’s problem with timestamps. Try to show if the messages are not saved with future timestamps. Try to use relative time frame selector and select to future dates.

  1. Check also that device uses UDP and not TCP.
  2. Check time synchronization with NTP and correct timezone

https://docs.graylog.org/en/4.0/pages/searching/time_frame_selector.html#absolute-time-frame-selector

3

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.