Some logs appear very late

Graylog Central (peer support)
1

Hello,
I just set up a Graylog server to receive authentication logs from all the servers on my network and it seems to be working fine.
All servers in the network first send their logs to a syslog server, there is one for the dmz and one for the internal zone.
Here is the configuration on each server in the/etc/rsyslog.conf file (here the server sends the logs to the internal syslog, it is the conf of one of the servers that has a problem):
image

So far I have no problem, all the logs of all the servers arrive well in my syslog server, which stores them in a folder specific to each server.
Example of a conf file for a server on my syslog server in/etc/rsyslog. d/ :
image

And here is the configuration of my syslog server rsyslog file so that it sends all connection logs to the graylog server:
image

However, the problem shows up on my graylog server. While my configuration is the same on each server, The connection logs of some servers do appears very late on my graylog. While they arrive immediatly on my syslog server and it sends all the connection logs it has. That’s why I can’t understand the problem.
image

For example, you can see here logs from a server, but not authentification logs (while I logged on several times on)

image

I would like to point out again that this is only for a few servers, as we can see here on a working server:
image
The message appeared instantly

Thanks to those who will try to help me

2

@Cruciani_Elliot on its face this seems like it may be an issue with timezones being set incorrectly, whether on the server or on the message. If you do an absolute search say from now, to a day in the future, do you see any logs showing up in the future?

3

hi @aaronsachs,
I didn’t suceed to see any logs in the future with the absolute search, but it was, as you said, a timezone problem.
I compared a functional server and another that sent the logs late with the command "date "and actually they were delayed by 1h towards the future.
Now that I have set the time I finally get the connection logs when the connection took place.
Thanks a lot!

4

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.