I now have GrayLog up and running on my main rsyslog server, centos 7. As far as I can tell rsyslog is collecting all the syslog information from my servers and work stations, but GrayLog can not see any of this. Question is am I doing something wrong, should I even be running rsyslog? I find t…

Yes, have read those instructions a few times. I expect if you know what is going on, they are pretty good. On the other hand if you are a person like me who is learning, they make little sense. Things like: UDP: *.* @graylog.example.org:514;RSYSLOG_SyslogProtocol23Format TCP: *.* @@graylog.e…

[image] GregoryWest: What am I supposed to do with those commands? They are configuration directives for rsyslog and thus have to be added to the rsyslog configuration file. Please refer to the rsyslog documentation for details: RSyslog Documentation - rsyslog

I added those lines to my rsyscon conf file. I am still not getting any messages into GrayLog. I seem to be having the same issues as a colleague of mine. He struggled with trying to get GreyLog to work, and finally ended up just giving up after a week of nothing working. I even downloaded yo…

It’s a little bit hard to help you without you providing any information about your setup. What inputs have you created in Graylog and what is their configuration? What’s the complete configuration of your rsyslog daemon? Are rsyslog and Graylog running on different systems? If so, can these syste…

TCP Syslog: allow_override_date: true bind_address: 10.10.10.54 expand_structured_data: false force_rdns: false max_message_size: 2097152 override_source: <empty> port: 514 recv_buffer_size: 1048576 store_full_message: false tcp_keepalive: false tls_cert_file: <empty> tls_client_auth: …

listen.conf is probably the wrong config file. Your rsyslog is not listening Graylog, but sending log lines to it. So try another conf file. The correcto one is probably /etc/rsyslogd.conf. Also, use only one of the two lines at a time. Also, when runnin CentOS you need to make the port 514 a rsy…

hmmm. listen.conf is the only rsyslog file there

Better then to read the link I gave first. One additional note, though. You make your life easier, if you use some other port for rsyslog than 514 (such as 5140) (as the first thousand ports are reserved for system daemons)

Syslog data collection for GrayLog

Graylog Central (peer support)

ritzk (Ritesh Khadgaray) July 28, 2017, 2:22am 2

Have you setup as documented at - https://github.com/Graylog2/graylog-guide-syslog-linux ?

Topic		Replies	Views
[solved] How i get rsyslog messages in graylog? misunderstanding Graylog Central (peer support)	5	9213	February 1, 2019
Issues with Syslog input Graylog Central (peer support)	21	7834	August 22, 2017
RSYSLOG UDP works but not SYSLOG TCP Graylog Central (peer support)	9	12692	October 6, 2017
Inputs Syslog UDP/TCP - FAILED Graylog Central (peer support)	2	4370	August 16, 2017
Rsyslog to graylog logs sending Graylog Central (peer support)	2	844	May 10, 2018

Syslog data collection for GrayLog

Related topics