# Syslog TCP SSL input with NGINX reverse proxy **URL:** \ **Category:** Graylog Central (peer support)\ **Created:** [December 13, 2023, 2:22pm UTC](https://community.graylog.org/t/syslog-tcp-ssl-input-with-nginx-reverse-proxy/30952 "2023-12-13T14:22:44Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![sinjiku](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/sinjiku/32/15468_2.png) [@sinjiku](https://community.graylog.org/u/sinjiku)\ **Post date:** [December 13, 2023, 2:22pm UTC](https://community.graylog.org/t/syslog-tcp-ssl-input-with-nginx-reverse-proxy/30952/1 "2023-12-13T14:22:44Z")
Hi I would like to check with you my conf, because I am not sure of the differents options. I have : - a Syslog input with TLS disabled - a NGINX reverse proxy - a linux server with rsyslog Everything seems to work fine, but when I first tried some logs were not recieved by graylog. After deactivated and reactivated the option \* ssl\_session\_cache\* in NGINX, all the logs are in graylog. So I am asking if my reverse proxy is good. Here are my conf of NGINX and syslog client NGINX reverse proxy 10.10.10.1 Graylog nodes 10.10.10.2 10.10.10.3 **NGINX** ```auto upstream linux_servers { server 10.10.10.2:10516; server 10.10.10.3:10516; } server { listen 10.10.10.1:10516 ssl; proxy_pass linux_servers; ssl_certificate /etc/nginx/ssl/nginx_crt.pem; ssl_certificate_key /etc/nginx/ssl/nginx_key.pem; ssl_protocols TLSv1.1 TLSv1.2 TLSv1.3; ssl_ciphers HIGH:!aNULL:!MD5; ssl_session_cache shared:SSL:20m; # ssl_session_cache off; ssl_session_timeout 4h; ssl_handshake_timeout 30s; } ``` **GRAYLOG Input** ```auto allow_override_date: true bind_address: 0.0.0.0 charset_name: UTF-8 expand_structured_data: false force_rdns: false max_message_size: 2097152 number_worker_threads: 16 override_source: port: 10516 recv_buffer_size: 1048576 store_full_message: true tcp_keepalive: false timezone: Europe/Paris tls_cert_file: tls_client_auth: disabled tls_client_auth_cert_file: tls_enable: false tls_key_file: tls_key_password: ******** use_null_delimiter: false ``` **RSYSLOG client** /etc/rsyslog.d/70-graylog.conf ```auto ## GTLS driver $DefaultNetstreamDriver gtls # Certificates $DefaultNetstreamDriverCAFile /etc/ssl/certs/ChainedCA.pem $DefaultNetstreamDriverCertFile /etc/ssl/rsyslog/wildcard_cert.pem $DefaultNetstreamDriverKeyFile /etc/ssl/rsyslog/wildcard_key.pem $ActionSendStreamDriverAuthMode x509/name $ActionSendStreamDriverPermittedPeer *.domain $ActionSendStreamDriverMode 1 # run driver in TLS-only mode *.* @@172.16.5.35:10516;RSYSLOG_SyslogProtocol23Format ``` - OS Information: Debian 11 - Package Version: 5.2.2 Have I missed something important to improve performance and fiability ? Thanks Marc ---
**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\ **Post date:** [December 16, 2023, 3:10am UTC](https://community.graylog.org/t/syslog-tcp-ssl-input-with-nginx-reverse-proxy/30952/2 "2023-12-16T03:10:59Z")
@sinjiku What Type of input are you using? It looks like your using TCP connection. ---
**Author:** ![sinjiku](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/sinjiku/32/15468_2.png) [@sinjiku](https://community.graylog.org/u/sinjiku)\ **Post date:** [December 20, 2023, 5:04pm UTC](https://community.graylog.org/t/syslog-tcp-ssl-input-with-nginx-reverse-proxy/30952/3 "2023-12-20T17:04:27Z")
Hi Yes it’s a input Syslog TCP ---
**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\ **Post date:** [December 21, 2023, 5:34am UTC](https://community.graylog.org/t/syslog-tcp-ssl-input-with-nginx-reverse-proxy/30952/4 "2023-12-21T05:34:45Z")
Did you try TCPDUMP on graylog server see if you can see the remote client? [tcpdump\_info](https://opensource.com/article/18/10/introduction-tcpdump) Your are send syslog TCP with Nginx proxy using certificates for port 10516 with `listen 10.10.10.1:10516 ssl.` this would be TCP/TLS. If this is correct then the INPUT should reflect with those certs I do believe. Troubleshooting would be is to disable your SSL and tried it with just `listen 10.10.10.1:10516;` Also one of our cummunity members posted this, > [@Nginx Config Examples](https://community.graylog.org/t/nginx-config-examples/20738): > > For those of you who use Nginx as a reverse proxy or load balancer, you may find these configuration files useful: Here’s the example main nginx config I use for load balancing tcp/udp connections: > > > **nginx.conf** > > > > user nginx; worker\_processes 4; error\_log /var/log/nginx/error.log warn; pid /var/run/nginx.pid; events { worker\_connections 1024; } http { include /etc/nginx/mime.types; default\_type application/octet-stream; log\_format main '$remote\_addr - $r… ---
**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\ **Post date:** [January 4, 2024, 5:35am UTC](https://community.graylog.org/t/syslog-tcp-ssl-input-with-nginx-reverse-proxy/30952/5 "2024-01-04T05:35:30Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.