Rsyslog and logs from Ubuntu to graylog

Hello && Welcome @kabo
I might be able to help.

As for that statement it not exactly true.

There are multiple way to ship logs to Graylog you may want to read the documentation here.

Second, when posting configuration files please use the markdown, In this section, of this post will enlighten you.

So I assume you created some input on Graylog? and one is Syslog UDP with port 1514?
It should look like this?

If all this is correct, check your Rsyslog log files on the client server, check to make sure there are no issues sending logs to graylog.

Since this is one way CLIENT → GRAYLOG I would use a TCPDUMP on graylog server to see if messages are getting received.
Example:
tcpdump -i eth0 dst 8.8.8.8 port 1514 -vvv

By the way I adjusted this post to make it readable.

Hope that helps

1 Like