I am new in this forum and Graylog. I have a problem with graylog and I can’t find the solution in marketplace or docs.
About the Marketplace, if I want to send log data ( sys, rsys etc. ) I should configure /etc/rsyslog.conf and listen 127.0.0.1 from graylog. But when I want to send log data from another computer I should write .@gri.example.com . So what should I do in my Graylog ?
I do not correctly understand what of Graylog is listening on 127.0.0.1… do you mean the Webinterface and the API?
The bind address should be an IP-address that is reachable by the log-senders. If you do not know any, use 0.0.0.0, as this will instruct Graylog to listen on all interfaces it has available. (Or check the global checkbox to start the input on 0.0.0.0 automatically on all nodes)
Which ports do you mean? The ports of the inputs you defined? These ports never change, unless you edit their configuration.
Can you please elaborate a bit more on your setup, since the current information is a bit lackluster
I’ve tried to listed 127.0.0.1:anyyport from my web interface. I’ve set up an udp sys log input and I need to take this input from another computer in same network.
For example, ip of my graylog server 192.168.56.50 and ip of my second server(this will send the log data to Graylog) is 192.168.56.51 , so I’ve made configuration settings from my second server ( I’ve write .@gri.oyas.com:1514;RSYSLOG_SyslogProtocol23Format ) but I can’t receive i puts from my Graylog server.
My question is, how can I receive my inputs from my Graylog server ?
How should I configure my input settings ?
Could you please post a screenshot of your Input configuration? This makes it easier to spot errors
Ok, could you check on the CLI of your Grayylog server with tcpdump -i lo udp port 1514 -vv -X
if the syslog-messages are reaching your Graylog server?
your Graylog should be able to receive messages. If none are showing up, please check other problems like wrong timestamps, misconfigured DNS (since you’re using dns in your sender) etc. )
