Server receive logs but don't go in Graylog

[JahRah (Raphaël Testi)]

Hello,

I create my input to get logs from my Windows 10 machine :

When my Windows 10 send the logs, the server receive the packet :

But the Graylog server doesn’t get any logs, he don’t receive anything :

What is the problem ? can’t understand…

tyty

[jochen]

Try using a Raw/Plaintext UDP input instead of a Syslog UDP input.

[JahRah (Raphaël Testi)]

I tried and don’t work :

[jochen]

What happens if you try to manually send a message to that input?

# echo "Test message" | nc -u SRV-LOG 5141

[JahRah (Raphaël Testi)]

It worked !

Seems to work in the same machine but not on an external machine…

[JahRah (Raphaël Testi)]

This is triggering me…

I try to wireshark when I send from the machine to server :

and with tcpdump, I see the packet…

[JahRah (Raphaël Testi)]

Can it be a problem with rights on mongodb ?

Maybe my Windows can’t write in the db because he doesn’t have rights ?

[jan (Jan Doberstein)]

how did you ingest the logs from Windows to Graylog? What transport did you use?

[JahRah (Raphaël Testi)]

I use SolarWinds to fake logs in Windows :

It’s just for the test that I use this app.

[JahRah (Raphaël Testi)]

I think I found Something.

Maybe my port is open for the machine only ?

[jan (Jan Doberstein)]

did you checked if any firewall is blocking the connection between the sender and the receiver?

[JahRah (Raphaël Testi)]

No firewall between them, just a switch