Syslog messages don't arrive on graylog, but shown in tcpdump

(Nicolas Devouge) #1

Hello, I have installed latest verison of graylog, and added a syslog udp input, port 5514. I have configured a server to send everything on, with this : . @ but nothing come. So with TCPdump on my Graylog box, I sniff with :

root@graylog:~# tcpdump host and port 5514 -vvvvv

( is my rsyslog client , and is my graylog box)

And I have traffic !

09:51:02.174515 IP (tos 0x0, ttl 64, id 57192, offset 0, flags [DF], proto UDP (17), length 208) > [udp sum ok] UDP, length 180
09:51:02.174641 IP (tos 0x0, ttl 64, id 57193, offset 0, flags [DF], proto UDP (17), length 208) > [udp sum ok] UDP, length 180
09:51:04.769492 IP (tos 0x0, ttl 64, id 57604, offset 0, flags [DF], proto UDP (17), length 115) > [udp sum ok] UDP, length 87
09:51:05.222753 IP (tos 0x0, ttl 64, id 57673, offset 0, flags [DF], proto UDP (17), length 254) > [udp sum ok] UDP, length 226

So my syslog packets arrive on the graylog box, but not in Graylog !

My iptable is cleared by :

iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X
iptables -P INPUT ACCEPT

And when I test with logger like this :

logger coucou -n -P 5514 ==> It works !

Two servers are Ubuntu 16.04, can anybody helps me ?

(Nicolas Devouge) #2

I reply to myself :slight_smile:
It’s a problem with time stmp, so I will modify the timestamp with parse_date(), a processing pipeline function:

(Jochen) #3

Why not fix it on the emitting device instead of rewriting it in Graylog?

Sometimes this isn’t possible, but it would be preferable.

(Nicolas Devouge) #4

I don’t know how :slight_smile:

My two box are is same time when I type ‘date’ , so I don’t know what’s going wrong ?

(Nicolas Devouge) #5
dpkg-reconfigure tzdata   

On Graylog box has solved the issue :slight_smile: So everything’s fine now !! Thank you @jochen !

(system) #6

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.