Recieve input from remote host or other computers

Hi there,

I am new in this forum and Graylog. I have a problem with graylog and I can’t find the solution in marketplace or docs.

About the Marketplace, if I want to send log data ( sys, rsys etc. ) I should configure /etc/rsyslog.conf and listen from graylog. But when I want to send log data from another computer I should write . . So what should I do in my Graylog ?

Where should be my Bind Adress ? and

Why graylog always change my ports ?

Note: I did all firewall configurations.

Thanks for help :slight_smile:

Hey @egetkn,

I do not correctly understand what of Graylog is listening on… do you mean the Webinterface and the API?

The bind address should be an IP-address that is reachable by the log-senders. If you do not know any, use, as this will instruct Graylog to listen on all interfaces it has available. (Or check the global checkbox to start the input on automatically on all nodes)

Which ports do you mean? The ports of the inputs you defined? These ports never change, unless you edit their configuration.

Can you please elaborate a bit more on your setup, since the current information is a bit lackluster :slight_smile:

Greetings - Phil

1 Like

Hello Phil and thanks for your answer.

I’ve tried to listed from my web interface. I’ve set up an udp sys log input and I need to take this input from another computer in same network.

For example, ip of my graylog server and ip of my second server(this will send the log data to Graylog) is , so I’ve made configuration settings from my second server ( I’ve write .;RSYSLOG_SyslogProtocol23Format ) but I can’t receive i puts from my Graylog server.

My question is, how can I receive my inputs from my Graylog server ?
How should I configure my input settings ?

Many thanks for answer again :slight_smile:

Hey @egetkn,

Could you please post a screenshot of your Input configuration? This makes it easier to spot errors :slight_smile:

Ok, could you check on the CLI of your Grayylog server with
tcpdump -i lo udp port 1514 -vv -X
if the syslog-messages are reaching your Graylog server?

If your Input looks like this:

your Graylog should be able to receive messages. If none are showing up, please check other problems like wrong timestamps, misconfigured DNS (since you’re using dns in your sender) etc. :slight_smile:)

Greetings - Phil

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.