I’m currently running a Graylog server on an Ubuntu Server 20.04 VM. It is configured to listen on UDP port 5514 for syslog messages and store them in graylog. On my other server VMs, I can configure rsyslog to send that server’s syslog messages to my Graylog server using UDP 5514 and Graylog receives them with no issues. However, I would also like the syslog messages from the server that is hosting Graylog to show up in Graylog itself. I tried creating an rsyslog file that sent messages to localhost:5514 via UDP but it seemed to end up in an infinite loop where rsyslog was sending messages to itself and then storing them in /var/log/syslog until the file filled up the entire drive and things started breaking due to a lack of storage space. Is there any way to have Graylog show log messages from its host without causing this infinite loop?
Thanks so much
Hello && welcome @tactile3765
Yes there is.
This would depend on the configurations that were made. Showing us would be helpful in troubleshooting this issue.
Here is the rsyslog configuration I was using for rsyslog:
And then here is the graylog input configuration:
Not sure why this is happing to you, perhaps check Selinux/ Firewalls, etc…
Here is my lab configurations , maybe that will help.
root@ansible:~# lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description: Ubuntu 20.04.4 LTS
root@ansible:/etc# cat /etc/rsyslog.conf | egrep -v "^\s*(#|$)"
module(load="imuxsock") # provides support for local system logging
Maybe try not to use localhost and try using 127.0.0.1 or the IP Address of this Graylog server. Just an idea for troubleshooting.