Rsyslog not sending logs - Permission denied

(Strix) #1

Hi all,

I’m totally new to Graylog, Rsyslog and Elasticsearch. So I’ve set up Graylog as per the guide http://docs.graylog.org and I can log in fine, no issuse on the server. Version are:

Host - Ubuntu 18.04
Graylog - 3.0.0-12
Java - 1.8.0_191
Elasticsearch - 6.6.1"
MongoDB - 4.0.6

I’m using Rsyslog to send the logs from a Ubuntu 18.04 server to Graylog.
So I followed Sending syslog from Linux systems into Graylog and created a conf file -
graylog_syslog.conf in /etc/rsyslog.d/ and added . @172.24.228.161:514;RSYSLOG_SyslogProtocol23Format to it and restarted rsyslog. Checking the Status it get:

sudo service rsyslog status
● rsyslog.service - System Logging Service
Loaded: loaded (/lib/systemd/system/rsyslog.service; enabled; vendor preset: enabled)
Active: active (running) since Thu 2019-02-21 10:35:30 UTC; 4min 3s ago
Docs: man:rsyslogd(8)
http://www.rsyslog.com/doc/
Main PID: 7840 (rsyslogd)
Tasks: 4 (limit: 2320)
CGroup: /system.slice/rsyslog.service
└─7840 /usr/sbin/rsyslogd -n

Feb 21 10:35:30 UBmanagent systemd[1]: Stopped System Logging Service.
Feb 21 10:35:30 UBmanagent systemd[1]: Starting System Logging Service…
Feb 21 10:35:30 UBmanagent systemd[1]: Started System Logging Service.
Feb 21 10:35:30 UBmanagent rsyslogd[7840]: imuxsock: Acquired UNIX socket ‘/run/systemd/journal/syslog’ (fd 3) from systemd. [v8.32.0]
Feb 21 10:35:30 UBmanagent rsyslogd[7840]: rsyslogd’s groupid changed to 106
Feb 21 10:35:30 UBmanagent rsyslogd[7840]: rsyslogd’s userid changed to 102
Feb 21 10:35:30 UBmanagent rsyslogd[7840]: [origin software=“rsyslogd” swVersion=“8.32.0” x-pid=“7840” x-info=“http://www.rsyslog.com”] start

I added n the Graylog server I added a new input as ‘Syslog UDP’, giving it a title and left everything as default. But is shows up as failed.

So I added the server IP the the Bind setting and the status changed to ‘Not running’
Checking the Graylog logs I get

I’m don’t know what is getting permission dined. Could any one point me in the right direction.

Thanks

1 Like

(Jan Doberstein) #2

the answer is in the FAQ

http://docs.graylog.org/en/3.0/pages/faq.html#how-can-i-start-an-input-on-a-port-below-1024


the quick answer - use a different port that is over 1024

2 Likes

(Strix) #3

Thanks Jan :slightly_smiling_face:, all running. Will do some readying up

0 Likes

(system) closed #4

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.

0 Likes