Server receive logs but don't go in Graylog

(Raphaël Testi) #1


I create my input to get logs from my Windows 10 machine :


When my Windows 10 send the logs, the server receive the packet :


But the Graylog server doesn’t get any logs, he don’t receive anything :


What is the problem ? can’t understand…


(Jochen) #2

Try using a Raw/Plaintext UDP input instead of a Syslog UDP input.

(Raphaël Testi) #3

I tried and don’t work :


(Jochen) #4

What happens if you try to manually send a message to that input?

# echo "Test message" | nc -u SRV-LOG 5141

(Raphaël Testi) #5

It worked !


Seems to work in the same machine but not on an external machine…

(Raphaël Testi) #6

This is triggering me…

I try to wireshark when I send from the machine to server :

and with tcpdump, I see the packet…

(Raphaël Testi) #7

Can it be a problem with rights on mongodb ?

Maybe my Windows can’t write in the db because he doesn’t have rights ?

(Jan Doberstein) #8

how did you ingest the logs from Windows to Graylog? What transport did you use?

(Raphaël Testi) #9

I use SolarWinds to fake logs in Windows :

It’s just for the test that I use this app.

(Raphaël Testi) #10

I think I found Something.


Maybe my port is open for the machine only ?

(Jan Doberstein) #11

did you checked if any firewall is blocking the connection between the sender and the receiver?

(Raphaël Testi) #12

No firewall between them, just a switch

(system) closed #13

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.