Server receive logs but don't go in Graylog


(Raphaël Testi) #1

Hello,

I create my input to get logs from my Windows 10 machine :

image

When my Windows 10 send the logs, the server receive the packet :

image

But the Graylog server doesn’t get any logs, he don’t receive anything :

image

What is the problem ? can’t understand…

tyty


(Jochen) #2

Try using a Raw/Plaintext UDP input instead of a Syslog UDP input.


(Raphaël Testi) #3

I tried and don’t work :

image


(Jochen) #4

What happens if you try to manually send a message to that input?

# echo "Test message" | nc -u SRV-LOG 5141

(Raphaël Testi) #5

It worked !

image

Seems to work in the same machine but not on an external machine…


(Raphaël Testi) #6

This is triggering me…

I try to wireshark when I send from the machine to server :

and with tcpdump, I see the packet…


(Raphaël Testi) #7

Can it be a problem with rights on mongodb ?

Maybe my Windows can’t write in the db because he doesn’t have rights ?


(Jan Doberstein) #8

how did you ingest the logs from Windows to Graylog? What transport did you use?


(Raphaël Testi) #9

I use SolarWinds to fake logs in Windows :

It’s just for the test that I use this app.


(Raphaël Testi) #10

I think I found Something.

image

Maybe my port is open for the machine only ?


(Jan Doberstein) #11

did you checked if any firewall is blocking the connection between the sender and the receiver?


(Raphaël Testi) #12

No firewall between them, just a switch


(system) #13

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.