Remote rsyslog Configuration for Ubuntu 22.04/24.04 to Graylog

Graylog Central (peer support)
1

Hi Graylog community,

I’m forwarding logs from two Ubuntu Server instances (22.04 and 24.04) to Graylog using a remote rsyslog configuration. I applied the following file on one server:

# /etc/rsyslog.d/90-graylog.conf
#############################################################################
# 1) Module laden
#############################################################################
#module(load="imuxsock")                                           # lokale Syslog-Sockets
#module(load="imklog")                                             # Kernel-Logs
module(load="imjournal" StateFile="/var/lib/rsyslog/imjournal.state" PersistStateInterval="10000")  # systemd-Journal
#module(load="imfile" mode="inotify")                              # File-Input

#############################################################################
# 2) Globale Direktiven
#############################################################################
global(workDirectory="/var/lib/rsyslog")                          # Arbeitsverzeichnis für Queues & StateFiles

#############################################################################
# 3) File Inputs (nur neue Logs, rotation- und crash-sicher)
#############################################################################
#input(
#  type="imfile"
#  File="/var/log/auth.log"
#  Tag="auth"
#  Facility="auth"
#  Severity="info"
#  StateFile="auth-log-state"
#  ignoreOlderThan="3600"            # nur Logs der letzten Stunde
#  freshStartTail="on"               # nur neue Zeilen beim Start
#  reopenOnTruncate="on"             # Rotation via copytruncate
#  PersistStateInterval="200"        # StateFile-Update alle 200 Zeilen
#  persistStateAfterSubmission="on"  # crash-resistent
#  addMetadata="on"                  # Dateiname & Offset als Felder
#)

# ... weitere inputs analog einfügen ...

#############################################################################
# 4) Remote-Forwarding an Graylog (TCP 5514, RFC5424)
#############################################################################
action(
  type="omfwd"
  name="toGraylog"
  target="graylog.domain.de"
  port="5514"
  protocol="tcp"
  Template="RSYSLOG_SyslogProtocol23Format"  # RFC5424-Standard
  TCP_Framing="octet-counted"                 # korrekte Paketgrenzen
  KeepAlive="on"                              # Verbindungsstabilität

  queue.type="LinkedList"                     # zuverlässiges Puffern
  queue.spoolDirectory="/var/lib/rsyslog/queues/graylog"
  queue.size="500000"
  queue.dequeueBatchSize="1000"
  queue.saveOnShutdown="on"
  action.resumeRetryCount="-1"
  action.resumeInterval="10"
)
# keine lokale Weiterverarbeitung
#& stop

After restarting rsyslog, I see this in Graylog’s details:

65537 messages in process buffer, 100.00% utilized.

grafik
grafik1899×852 59.1 KB

My goal is to have all logs reliably sent to Graylog without buffer overflows. Could someone please review my configuration and suggest any corrections or best practices?

I have the feeling that it’s due to my configuration and that it always sends entire files to the Graylog server instead of starting at the end of each file and only sending new logs. I can’t imagine it any other way. One server is sending tens of millions of log entries to Graylog, even though there can never be that many new logs.

I’m also seeing tens of thousands of entries in Graylog itself like this:

{
  "gl2_accounted_message_size": 16306,
  "gl2_receive_timestamp": "2025-06-20 18:48:45.585",
  "level": 6,
  "gl2_remote_ip": "192.168.81.16",
  "gl2_remote_port": 43582,
  "streams": [
    "000000000000000000000001"
  ],
  "gl2_message_id": "01JY7AQZ8H06FCM45XCQWENG3R",
  "source": "v0017",
  "message": "Jun 20 20:48:45 v0017 auth Jun 20 20:48:45 v0017 auth Jun 20 20:48:44 v0017 auth Jun 20 20:48:44 v0017 auth Jun 20 20:48:44 v0017 auth Jun 20 20:48:44 v0017 auth Jun 20 20:48:44 v0017 auth Jun 20 20:48:43 v0017 auth Jun 20 20:48:43 v0017 auth Jun 20 20:48:43 v0017 auth Jun 20 20:48:43 v0017 auth Jun 20 20:48:43 v0017 auth Jun 20 20:48:42 v0017 auth Jun 20 20:48:42 v0017 auth Jun 20 20:48:42 v0017 auth Jun 20 20:48:41 v0017 auth Jun 20 20:48:41 v0017 auth Jun 20 20:48:41 v0017 auth Jun 20 20:48:41 v0017 auth Jun 20 20:48:41 v0017 auth Jun 20 20:48:40 v0017 auth Jun 20 20:48:40 v0017 auth Jun 20 20:48:40 v0017 auth Jun 20 20:48:40 v0017 auth Jun 20 20:48:40 v0017 auth Jun 20 20:48:39 v0017 auth Jun 20 20:48:39 v0017 auth Jun 20 20:48:39 v0017 auth Jun 20 20:48:39 v0017 auth Jun 20 20:48:38 v0017 auth Jun 20 20:48:38 v0017 auth Jun 20 20:48:38 v0017 auth Jun 20 20:48:38 v0017 auth Jun 20 20:48:38 v0017 auth Jun 20 20:48:37 v0017 auth Jun 20 20:48:37 v0017 auth Jun 20 20:48:37 v0017 auth Jun 20 20:48:37 v0017 auth Jun 20 20:48:36 v0017 auth Jun 20 20:48:36 v0017 auth Jun 20 20:48:36 v0017 auth Jun 20 20:48:36 v0017 auth Jun 20 20:48:36 v0017 auth Jun 20 20:48:35 v0017 auth Jun 20 20:48:35 v0017 auth Jun 20 20:48:35 v0017 auth Jun 20 20:48:35 v0017 auth Jun 20 20:48:35 v0017 auth Jun 20 20:48:34 v0017 auth Jun 20 20:48:34 v0017 auth Jun 20 20:48:34 v0017 auth Jun 20 20:48:34 v0017 auth Jun 20 20:48:33 v0017 auth Jun 20 20:48:33 v0017 auth Jun 20 20:48:33 v0017 auth Jun 20 20:48:33 v0017 auth Jun 20 20:48:33 v0017 auth Jun 20 20:48:32 v0017 auth Jun 20 20:48:32 v0017 auth Jun 20 20:48:32 v0017 auth Jun 20 20:48:32 v0017 auth Jun 20 20:48:32 v0017 auth Jun 20 20:48:31 v0017 auth Jun 20 20:48:31 v0017 auth Jun 20 20:48:31 v0017 auth Jun 20 20:48:31 v0017 auth Jun 20 20:48:30 v0017 auth Jun 20 20:48:30 v0017 auth Jun 20 20:48:30 v0017 auth Jun 20 20:48:30 v0017 auth Jun 20 20:48:30 v0017 auth Jun 20 20:48:29 v0017 auth Jun 20 20:48:29 v0017 auth Jun 20 20:48:29 v0017 auth Jun 20 20:48:29 v0017 auth Jun 20 20:48:28 v0017 auth Jun 20 20:48:28 v0017 auth Jun 20 20:48:28 v0017 auth Jun 20 20:48:28 v0017 auth Jun 20 20:48:28 v0017 auth Jun 20 20:48:27 v0017 auth Jun 20 20:48:27 v0017 auth Jun 20 20:48:27 v0017 auth Jun 20 20:48:27 v0017 auth Jun 20 20:48:26 v0017 auth Jun 20 20:48:26 v0017 auth Jun 20 20:48:26 v0017 auth Jun 20 20:48:26 v0017 auth Jun 20 20:48:26 v0017 auth Jun 20 20:48:25 v0017 auth Jun 20 20:48:25 v0017 auth Jun 20 20:48:25 v0017 auth Jun 20 20:48:25 v0017 auth Jun 20 20:48:24 v0017 auth Jun 20 20:48:24 v0017 auth Jun 20 20:48:24 v0017 auth Jun 20 20:48:24 v0017 auth Jun 20 20:48:24 v0017 auth Jun 20 20:48:23 v0017 auth Jun 20 20:48:23 v0017 auth Jun 20 20:48:23 v0017 auth Jun 20 20:48:23 v0017 auth Jun 20 20:48:22 v0017 auth Jun 20 20:48:22 v0017 auth Jun 20 20:48:22 v0017 auth Jun 20 20:48:22 v0017 auth Jun 20 20:48:22 v0017 auth Jun 20 20:48:21 v0017 auth Jun 20 20:48:21 v0017 auth Jun 20 20:48:21 v0017 auth Jun 20 20:48:21 v0017 auth Jun 20 20:48:20 v0017 auth Jun 20 20:48:20 v0017 auth Jun 20 20:48:20 v0017 auth Jun 20 20:48:20 v0017 auth Jun 20 20:48:20 v0017 auth Jun 20 20:48:19 v0017 auth Jun 20 20:48:19 v0017 auth Jun 20 20:48:19 v0017 auth Jun 20 20:48:19 v0017 auth Jun 20 20:48:19 v0017 auth Jun 20 20:48:18 v0017 auth Jun 20 20:48:18 v0017 auth Jun 20 20:48:18 v0017 auth Jun 20 20:48:18 v0017 auth Jun 20 20:48:17 v0017 auth Jun 20 20:48:17 v0017 auth Jun 20 20:48:17 v0017 auth Jun 20 20:48:17 v0017 auth Jun 20 20:48:17 v0017 auth Jun 20 20:48:16 v0017 auth Jun 20 20:48:16 v0017 auth Jun 20 20:48:16 v0017 auth Jun 20 20:48:16 v0017 auth Jun 20 20:48:15 v0017 auth Jun 20 20:48:15 v0017 auth Jun 20 20:48:15 v0017 auth Jun 20 20:48:15 v0017 auth Jun 20 20:48:15 v0017 auth Jun 20 20:48:14 v0017 auth Jun 20 20:48:14 v0017 auth Jun 20 20:48:14 v0017 auth Jun 20 20:48:14 v0017 auth Jun 20 20:48:13 v0017 auth Jun 20 20:48:13 v0017 auth Jun 20 20:48:13 v0017 auth Jun 20 20:48:13 v0017 auth Jun 20 20:48:13 v0017 auth Jun 20 20:48:12 v0017 auth Jun 20 20:48:12 v0017 auth Jun 20 20:48:12 v0017 auth Jun 20 20:48:12 v0017 auth Jun 20 20:48:11 v0017 auth Jun 20 20:48:11 v0017 auth Jun 20 20:48:11 v0017 auth Jun 20 20:48:11 v0017 auth Jun 20 20:48:11 v0017 auth Jun 20 20:48:10 v0017 auth Jun 20 20:48:10 v0017 auth Jun 20 20:48:10 v0017 auth Jun 20 20:48:10 v0017 auth Jun 20 20:48:09 v0017 auth Jun 20 20:48:09 v0017 auth Jun 20 20:48:09 v0017 auth Jun 20 20:48:09 v0017 auth Jun 20 20:48:09 v0017 auth Jun 20 20:48:08 v0017 auth Jun 20 20:48:08 v0017 auth Jun 20 20:48:08 v0017 auth Jun 20 20:48:08 v0017 auth Jun 20 20:48:07 v0017 auth Jun 20 20:48:07 v0017 auth Jun 20 20:48:07 v0017 auth Jun 20 20:48:07 v0017 auth Jun 20 20:48:07 v0017 auth Jun 20 20:48:06 v0017 auth Jun 20 20:48:06 v0017 auth Jun 20 20:48:06 v0017 auth Jun 20 20:48:06 v0017 auth Jun 20 20:48:05 v0017 auth Jun 20 20:48:05 v0017 auth Jun 20 20:48:05 v0017 auth Jun 20 20:48:05 v0017 auth Jun 20 20:48:05 v0017 auth Jun 20 20:48:04 v0017 auth Jun 20 20:48:04 v0017 auth Jun 20 20:48:04 v0017 auth Jun 20 20:48:04 v0017 auth Jun 20 20:48:04 v0017 auth Jun 20 20:48:03 v0017 auth Jun 20 20:48:03 v0017 auth Jun 20 20:48:03 v0017 auth Jun 20 20:48:03 v0017 auth Jun 20 20:48:02 v0017 auth Jun 20 20:48:02 v0017 auth Jun 20 20:48:02 v0017 auth Jun 20 20:48:02 v0017 auth Jun 20 20:48:01 v0017 auth Jun 20 20:48:01 v0017 auth Jun 20 20:48:01 v0017 auth Jun 20 20:48:01 v0017 auth Jun 20 20:48:00 v0017 auth Jun 20 20:48:00 v0017 auth Jun 20 20:48:00 v0017 auth Jun 20 20:48:00 v0017 auth Jun 20 20:48:00 v0017 auth Jun 20 20:47:59 v0017 auth Jun 20 20:47:59 v0017 auth Jun 20 20:47:59 v0017 auth Jun 20 20:47:59 v0017 auth Jun 20 20:47:58 v0017 auth Jun 20 20:47:58 v0017 auth Jun 20 20:47:58 v0017 auth Jun 20 20:47:58 v0017 auth Jun 20 20:47:58 v0017 auth Jun 20 20:47:57 v0017 auth Jun 20 20:47:57 v0017 auth Jun 20 20:47:57 v0017 auth Jun 20 20:47:57 v0017 auth Jun 20 20:47:56 v0017 auth Jun 20 20:47:56 v0017 auth Jun 20 20:47:56 v0017 auth Jun 20 20:47:56 v0017 auth Jun 20 20:47:56 v0017 auth Jun 20 20:47:55 v0017 auth Jun 20 20:47:55 v0017 auth Jun 20 20:47:55 v0017 auth Jun 20 20:47:55 v0017 auth Jun 20 20:47:54 v0017 auth Jun 20 20:47:54 v0017 auth Jun 20 20:47:54 v0017 auth Jun 20 20:47:54 v0017 auth Jun 20 20:47:54 v0017 auth Jun 20 20:47:53 v0017 auth Jun 20 20:47:53 v0017 auth Jun 20 20:47:53 v0017 auth Jun 20 20:47:53 v0017 auth Jun 20 20:47:53 v0017 auth Jun 20 20:47:52 v0017 auth Jun 20 20:47:52 v0017 auth Jun 20 20:47:52 v0017 auth Jun 20 20:47:52 v0017 auth Jun 20 20:47:52 v0017 auth Jun 20 20:47:51 v0017 auth Jun 20 20:47:51 v0017 auth Jun 20 20:47:51 v0017 auth Jun 20 20:47:51 v0017 auth Jun 20 20:47:50 v0017 auth Jun 20 20:47:50 v0017 auth Jun 20 20:47:50 v0017 auth Jun 20 20:47:50 v0017 auth Jun 20 20:47:49 v0017 auth Jun 20 20:47:49 v0017 auth Jun 20 20:47:49 v0017 auth Jun 20 20:47:49 v0017 auth Jun 20 20:47:49 v0017 auth Jun 20 20:47:48 v0017 auth Jun 20 20:47:48 v0017 auth Jun 20 20:47:48 v0017 auth Jun 20 20:47:48 v0017 auth Jun 20 20:47:47 v0017 auth Jun 20 20:47:47 v0017 auth Jun 20 20:47:47 v0017 auth Jun 20 20:47:47 v0017 auth Jun 20 20:47:46 v0017 auth Jun 20 20:47:46 v0017 auth Jun 20 20:47:46 v0017 auth Jun 20 20:47:46 v0017 auth Jun 20 20:47:46 v0017 auth Jun 20 20:47:45 v0017 auth Jun 20 20:47:45 v0017 auth Jun 20 20:47:45 v0017 auth Jun 20 20:47:45 v0017 auth Jun 20 20:47:45 v0017 auth Jun 20 20:47:44 v0017 auth Jun 20 20:47:44 v0017 auth Jun 20 20:47:44 v0017 auth Jun 20 20:47:44 v0017 auth Jun 20 20:47:43 v0017 auth Jun 20 20:47:43 v0017 auth Jun 20 20:47:43 v0017 auth Jun 20 20:47:43 v0017 auth Jun 20 20:47:43 v0017 auth Jun 20 20:47:42 v0017 auth Jun 20 20:47:42 v0017 auth Jun 20 20:47:42 v0017 auth Jun 20 20:47:42 v0017 auth Jun 20 20:47:41 v0017 auth Jun 20 20:47:41 v0017 auth Jun 20 20:47:41 v0017 auth Jun 20 20:47:41 v0017 auth Jun 20 20:47:40 v0017 auth Jun 20 20:47:40 v0017 auth Jun 20 20:47:40 v0017 auth Jun 20 20:47:40 v0017 auth Jun 20 20:47:39 v0017 auth Jun 20 20:47:39 v0017 auth Jun 20 20:47:39 v0017",
  "gl2_source_input": "67d7e7a0ce664d0b6c0c5734",
  "gl2_processing_timestamp": "2025-06-20 20:33:53.737",
  "application_name": "auth",
  "full_message": "<38>1 2025-06-20T20:48:45.585190+02:00 v0017 auth - - - Jun 20 20:48:45 v0017 auth Jun 20 20:48:45 v0017 auth Jun 20 20:48:44 v0017 auth Jun 20 20:48:44 v0017 auth Jun 20 20:48:44 v0017 auth Jun 20 20:48:44 v0017 auth Jun 20 20:48:44 v0017 auth Jun 20 20:48:43 v0017 auth Jun 20 20:48:43 v0017 auth Jun 20 20:48:43 v0017 auth Jun 20 20:48:43 v0017 auth Jun 20 20:48:43 v0017 auth Jun 20 20:48:42 v0017 auth Jun 20 20:48:42 v0017 auth Jun 20 20:48:42 v0017 auth Jun 20 20:48:41 v0017 auth Jun 20 20:48:41 v0017 auth Jun 20 20:48:41 v0017 auth Jun 20 20:48:41 v0017 auth Jun 20 20:48:41 v0017 auth Jun 20 20:48:40 v0017 auth Jun 20 20:48:40 v0017 auth Jun 20 20:48:40 v0017 auth Jun 20 20:48:40 v0017 auth Jun 20 20:48:40 v0017 auth Jun 20 20:48:39 v0017 auth Jun 20 20:48:39 v0017 auth Jun 20 20:48:39 v0017 auth Jun 20 20:48:39 v0017 auth Jun 20 20:48:38 v0017 auth Jun 20 20:48:38 v0017 auth Jun 20 20:48:38 v0017 auth Jun 20 20:48:38 v0017 auth Jun 20 20:48:38 v0017 auth Jun 20 20:48:37 v0017 auth Jun 20 20:48:37 v0017 auth Jun 20 20:48:37 v0017 auth Jun 20 20:48:37 v0017 auth Jun 20 20:48:36 v0017 auth Jun 20 20:48:36 v0017 auth Jun 20 20:48:36 v0017 auth Jun 20 20:48:36 v0017 auth Jun 20 20:48:36 v0017 auth Jun 20 20:48:35 v0017 auth Jun 20 20:48:35 v0017 auth Jun 20 20:48:35 v0017 auth Jun 20 20:48:35 v0017 auth Jun 20 20:48:35 v0017 auth Jun 20 20:48:34 v0017 auth Jun 20 20:48:34 v0017 auth Jun 20 20:48:34 v0017 auth Jun 20 20:48:34 v0017 auth Jun 20 20:48:33 v0017 auth Jun 20 20:48:33 v0017 auth Jun 20 20:48:33 v0017 auth Jun 20 20:48:33 v0017 auth Jun 20 20:48:33 v0017 auth Jun 20 20:48:32 v0017 auth Jun 20 20:48:32 v0017 auth Jun 20 20:48:32 v0017 auth Jun 20 20:48:32 v0017 auth Jun 20 20:48:32 v0017 auth Jun 20 20:48:31 v0017 auth Jun 20 20:48:31 v0017 auth Jun 20 20:48:31 v0017 auth Jun 20 20:48:31 v0017 auth Jun 20 20:48:30 v0017 auth Jun 20 20:48:30 v0017 auth Jun 20 20:48:30 v0017 auth Jun 20 20:48:30 v0017 auth Jun 20 20:48:30 v0017 auth Jun 20 20:48:29 v0017 auth Jun 20 20:48:29 v0017 auth Jun 20 20:48:29 v0017 auth Jun 20 20:48:29 v0017 auth Jun 20 20:48:28 v0017 auth Jun 20 20:48:28 v0017 auth Jun 20 20:48:28 v0017 auth Jun 20 20:48:28 v0017 auth Jun 20 20:48:28 v0017 auth Jun 20 20:48:27 v0017 auth Jun 20 20:48:27 v0017 auth Jun 20 20:48:27 v0017 auth Jun 20 20:48:27 v0017 auth Jun 20 20:48:26 v0017 auth Jun 20 20:48:26 v0017 auth Jun 20 20:48:26 v0017 auth Jun 20 20:48:26 v0017 auth Jun 20 20:48:26 v0017 auth Jun 20 20:48:25 v0017 auth Jun 20 20:48:25 v0017 auth Jun 20 20:48:25 v0017 auth Jun 20 20:48:25 v0017 auth Jun 20 20:48:24 v0017 auth Jun 20 20:48:24 v0017 auth Jun 20 20:48:24 v0017 auth Jun 20 20:48:24 v0017 auth Jun 20 20:48:24 v0017 auth Jun 20 20:48:23 v0017 auth Jun 20 20:48:23 v0017 auth Jun 20 20:48:23 v0017 auth Jun 20 20:48:23 v0017 auth Jun 20 20:48:22 v0017 auth Jun 20 20:48:22 v0017 auth Jun 20 20:48:22 v0017 auth Jun 20 20:48:22 v0017 auth Jun 20 20:48:22 v0017 auth Jun 20 20:48:21 v0017 auth Jun 20 20:48:21 v0017 auth Jun 20 20:48:21 v0017 auth Jun 20 20:48:21 v0017 auth Jun 20 20:48:20 v0017 auth Jun 20 20:48:20 v0017 auth Jun 20 20:48:20 v0017 auth Jun 20 20:48:20 v0017 auth Jun 20 20:48:20 v0017 auth Jun 20 20:48:19 v0017 auth Jun 20 20:48:19 v0017 auth Jun 20 20:48:19 v0017 auth Jun 20 20:48:19 v0017 auth Jun 20 20:48:19 v0017 auth Jun 20 20:48:18 v0017 auth Jun 20 20:48:18 v0017 auth Jun 20 20:48:18 v0017 auth Jun 20 20:48:18 v0017 auth Jun 20 20:48:17 v0017 auth Jun 20 20:48:17 v0017 auth Jun 20 20:48:17 v0017 auth Jun 20 20:48:17 v0017 auth Jun 20 20:48:17 v0017 auth Jun 20 20:48:16 v0017 auth Jun 20 20:48:16 v0017 auth Jun 20 20:48:16 v0017 auth Jun 20 20:48:16 v0017 auth Jun 20 20:48:15 v0017 auth Jun 20 20:48:15 v0017 auth Jun 20 20:48:15 v0017 auth Jun 20 20:48:15 v0017 auth Jun 20 20:48:15 v0017 auth Jun 20 20:48:14 v0017 auth Jun 20 20:48:14 v0017 auth Jun 20 20:48:14 v0017 auth Jun 20 20:48:14 v0017 auth Jun 20 20:48:13 v0017 auth Jun 20 20:48:13 v0017 auth Jun 20 20:48:13 v0017 auth Jun 20 20:48:13 v0017 auth Jun 20 20:48:13 v0017 auth Jun 20 20:48:12 v0017 auth Jun 20 20:48:12 v0017 auth Jun 20 20:48:12 v0017 auth Jun 20 20:48:12 v0017 auth Jun 20 20:48:11 v0017 auth Jun 20 20:48:11 v0017 auth Jun 20 20:48:11 v0017 auth Jun 20 20:48:11 v0017 auth Jun 20 20:48:11 v0017 auth Jun 20 20:48:10 v0017 auth Jun 20 20:48:10 v0017 auth Jun 20 20:48:10 v0017 auth Jun 20 20:48:10 v0017 auth Jun 20 20:48:09 v0017 auth Jun 20 20:48:09 v0017 auth Jun 20 20:48:09 v0017 auth Jun 20 20:48:09 v0017 auth Jun 20 20:48:09 v0017 auth Jun 20 20:48:08 v0017 auth Jun 20 20:48:08 v0017 auth Jun 20 20:48:08 v0017 auth Jun 20 20:48:08 v0017 auth Jun 20 20:48:07 v0017 auth Jun 20 20:48:07 v0017 auth Jun 20 20:48:07 v0017 auth Jun 20 20:48:07 v0017 auth Jun 20 20:48:07 v0017 auth Jun 20 20:48:06 v0017 auth Jun 20 20:48:06 v0017 auth Jun 20 20:48:06 v0017 auth Jun 20 20:48:06 v0017 auth Jun 20 20:48:05 v0017 auth Jun 20 20:48:05 v0017 auth Jun 20 20:48:05 v0017 auth Jun 20 20:48:05 v0017 auth Jun 20 20:48:05 v0017 auth Jun 20 20:48:04 v0017 auth Jun 20 20:48:04 v0017 auth Jun 20 20:48:04 v0017 auth Jun 20 20:48:04 v0017 auth Jun 20 20:48:04 v0017 auth Jun 20 20:48:03 v0017 auth Jun 20 20:48:03 v0017 auth Jun 20 20:48:03 v0017 auth Jun 20 20:48:03 v0017 auth Jun 20 20:48:02 v0017 auth Jun 20 20:48:02 v0017 auth Jun 20 20:48:02 v0017 auth Jun 20 20:48:02 v0017 auth Jun 20 20:48:01 v0017 auth Jun 20 20:48:01 v0017 auth Jun 20 20:48:01 v0017 auth Jun 20 20:48:01 v0017 auth Jun 20 20:48:00 v0017 auth Jun 20 20:48:00 v0017 auth Jun 20 20:48:00 v0017 auth Jun 20 20:48:00 v0017 auth Jun 20 20:48:00 v0017 auth Jun 20 20:47:59 v0017 auth Jun 20 20:47:59 v0017 auth Jun 20 20:47:59 v0017 auth Jun 20 20:47:59 v0017 auth Jun 20 20:47:58 v0017 auth Jun 20 20:47:58 v0017 auth Jun 20 20:47:58 v0017 auth Jun 20 20:47:58 v0017 auth Jun 20 20:47:58 v0017 auth Jun 20 20:47:57 v0017 auth Jun 20 20:47:57 v0017 auth Jun 20 20:47:57 v0017 auth Jun 20 20:47:57 v0017 auth Jun 20 20:47:56 v0017 auth Jun 20 20:47:56 v0017 auth Jun 20 20:47:56 v0017 auth Jun 20 20:47:56 v0017 auth Jun 20 20:47:56 v0017 auth Jun 20 20:47:55 v0017 auth Jun 20 20:47:55 v0017 auth Jun 20 20:47:55 v0017 auth Jun 20 20:47:55 v0017 auth Jun 20 20:47:54 v0017 auth Jun 20 20:47:54 v0017 auth Jun 20 20:47:54 v0017 auth Jun 20 20:47:54 v0017 auth Jun 20 20:47:54 v0017 auth Jun 20 20:47:53 v0017 auth Jun 20 20:47:53 v0017 auth Jun 20 20:47:53 v0017 auth Jun 20 20:47:53 v0017 auth Jun 20 20:47:53 v0017 auth Jun 20 20:47:52 v0017 auth Jun 20 20:47:52 v0017 auth Jun 20 20:47:52 v0017 auth Jun 20 20:47:52 v0017 auth Jun 20 20:47:52 v0017 auth Jun 20 20:47:51 v0017 auth Jun 20 20:47:51 v0017 auth Jun 20 20:47:51 v0017 auth Jun 20 20:47:51 v0017 auth Jun 20 20:47:50 v0017 auth Jun 20 20:47:50 v0017 auth Jun 20 20:47:50 v0017 auth Jun 20 20:47:50 v0017 auth Jun 20 20:47:49 v0017 auth Jun 20 20:47:49 v0017 auth Jun 20 20:47:49 v0017 auth Jun 20 20:47:49 v0017 auth Jun 20 20:47:49 v0017 auth Jun 20 20:47:48 v0017 auth Jun 20 20:47:48 v0017 auth Jun 20 20:47:48 v0017 auth Jun 20 20:47:48 v0017 auth Jun 20 20:47:47 v0017 auth Jun 20 20:47:47 v0017 auth Jun 20 20:47:47 v0017 auth Jun 20 20:47:47 v0017 auth Jun 20 20:47:46 v0017 auth Jun 20 20:47:46 v0017 auth Jun 20 20:47:46 v0017 auth Jun 20 20:47:46 v0017 auth Jun 20 20:47:46 v0017 auth Jun 20 20:47:45 v0017 auth Jun 20 20:47:45 v0017 auth Jun 20 20:47:45 v0017 auth Jun 20 20:47:45 v0017 auth Jun 20 20:47:45 v0017 auth Jun 20 20:47:44 v0017 auth Jun 20 20:47:44 v0017 auth Jun 20 20:47:44 v0017 auth Jun 20 20:47:44 v0017 auth Jun 20 20:47:43 v0017 auth Jun 20 20:47:43 v0017 auth Jun 20 20:47:43 v0017 auth Jun 20 20:47:43 v0017 auth Jun 20 20:47:43 v0017 auth Jun 20 20:47:42 v0017 auth Jun 20 20:47:42 v0017 auth Jun 20 20:47:42 v0017 auth Jun 20 20:47:42 v0017 auth Jun 20 20:47:41 v0017 auth Jun 20 20:47:41 v0017 auth Jun 20 20:47:41 v0017 auth Jun 20 20:47:41 v0017 auth Jun 20 20:47:40 v0017 auth Jun 20 20:47:40 v0017 auth Jun 20 20:47:40 v0017 auth Jun 20 20:47:40 v0017 auth Jun 20 20:47:39 v0017 auth Jun 20 20:47:39 v0017 auth Jun 20 20:47:39 v0017",
  "facility_num": 4,
  "gl2_source_node": "43d51100-15f9-4b50-a63d-91a98f063065",
  "_id": "e18c1860-4e15-11f0-ba95-662cd94985a9",
  "facility": "security/authorization",
  "gl2_processing_duration_ms": 6308152,
  "timestamp": "2025-06-20T18:48:45.585Z"
}

That can’t be normal.

Graylog Docker Version:
Graylog 6.1.12+23f653e on server (Eclipse Adoptium 17.0.15 on Linux 5.15.0-141-generic)

Thank you in advance for your help!