Hi, I added a Stream called “SSHD” when I use; Field application_name must match exactly sshd (sshd) If I do manually a search with sshd I get results but in stream SSHD I can’t see any entry. Why? What should I add? thanks.

If you look at the example message you mention, what are the contents of the time related fields and the application_name field in that message, after Graylog has run all extractors and pipeline functions you have defined?

Thanks for reply. I paste you a full trace. Hour 7:04 2017-06-13 07:00:21.392 mail PAM 1 more authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.X.X user=root 70eba514-4ff6-11e7-b3fe-000000000000 Received by Syslog on 76899de3 / mydomain.com Stored in index gray…

hi, look at the timestamp value and compare with the message content. Seems you have defined timezones so that there is a two timezone difference. You could recheck your timezone settings and if necessary, add a date converter for the message.

Hi, I am logging in Graylog with timezone -> "Madrid" In server I re-did dpkg-reconfigure tzdata and again setup “Europe/Madrid” (it was right) Hour server is # date Tue Jun 13 12:56:26 CEST 2017 I think that in both sites I have same timezone. However, more weird, I setup a “Alert” to send me …

I use timezone=UTC for graylog internally, but for Graylog users the local timezone. All logs are converted to UTC when received, so the user will see the correct time. You can check from System/Overview, what Graylog thinks the time zones are.

So, time server UTC? With dpkg-reconfigure tzdata which choose? In System/Overview (my user) I use “Madrid”. And what do u think about alerts? Thanks again.

Don’t worry about tzdata. The point is that if you look at the timestamp field, it shows Z as time zone, i.e. UTC. If that time is wrong, after converting back to your local timezone, you need to add a date converter for that input. It is better to make the timestamp work OK before worrying about…

Well, really time in server in same than graylog. Mi own laptop if have 10 minutes less but don’t worry. However if I try to login to my server and I fail, Graylog take that log, its ok (with some minutes less but don’t worry). I can go Stream, search “sshd” and I will see my fail login, but if th…

Over here: http://docs.graylog.org/en/2.2/pages/extractors.html That page covers date converters that can be used to fix timezone issues.

… and for the email issue: you can try to send test alert emails from Alerts/Manage notification That way you can first check that your email configuration is OK, so that the problem is not there. If the test email work, then the problem could be in stream settings.

Streams Graylog

Graylog Central (peer support)

jan (Jan Doberstein) June 14, 2017, 3:06pm 22

The explanation is:

Topic		Replies	Views
Timestamp in Elastisearch query Graylog Central (peer support)	7	2883	December 22, 2017
Mail alerts and timezones Graylog Central (peer support)	0	370	October 25, 2018
Grok Extractor Try succeeds, but not fields in search Graylog Central (peer support) basic-configuration	6	1448	November 24, 2021
Timezone issues. Logs are shown 1 hour behind Graylog Central (peer support)	7	3583	September 3, 2020
Bug, or my ignorance on my part? Graylog Central (peer support)	0	685	June 4, 2020

Streams Graylog

Related topics