Throughput shows messages are comming but input is empty

Graylog Central (peer support)
1

Hello

I hope everyone is doing well under this unusual circumstances. This is my first post and inquiry so I’ll try to be as precise as possible.

I have 3 Windows DC’s configured and each has its own Input. Throughput statistics shows that the messages are coming (attached pic). However, when I click on Show received messages, two out of three inputs shows no messages. Basically, I can find logs only from host02. Since I am not maintaining the whole infrastructure, I was wondering if such issue may be related to configuration on domain controllers log collectors (in order to submit a ticket to support) or maybe relates to Graylog server wrong setting I might missed (something that I can try to fix). Thanks.

msedge_2020-03-19_10-18-12
msedge_2020-03-19_10-18-121878×731 71.4 KB

2

Check the timezone of Graylog. They are probably there, they’re just not showing up in the search because of the time.

3

and after check the traffic format. You highlighted network IO, but if you got the messages in wrong format maybe graylog drop the messages.
So check:

  • server.log
  • WUI - system/overview - indexer failures
  • tcpdump

@tywjohn

The “show received messages” in basic shows the all messages. But you are right, it is a possible mistake if you try to search for a message. So it’s only a half point.

4

Thanks for the suggestions.

Graylog time and timezone is fine. However, I’ll set to check timezone on symptomatic DC’s. I also verified indexer failures, it is clean. I’ll post info upon resolution.

5

If you login as admin to graylog web interface, check if you setup correct timezone in /etc/graylog/server/server.conf:

root_timezone = Europe/Bratislava

Change Europe/Bratislava to your real timezone and restart graylog service.
https://docs.graylog.org/en/3.2/pages/configuration/server.conf.html#general

If you use another user account check your timezone in your profile in graylog, if it’s correct.

6

Hello, thank you for the suggestion. I do not have access to host operating system, it is being maintained by third party, but I will instruct them to check server.conf file. At this time I verified time configuration at System/Overview and it seems correct. Since I receive messages from 1 of 3 domain controllers, I will push support to inspect settings on the domain controllers. Graylog inputs looks correct.

7

you can always check your time configuration on the System/Overview tab about halfway down the screen

image

8

It turns out that solarwinds log forwarder was installed on domain contollers for which logs were missing. Engineer was unable to resolve the issue with logs being forwarded to Graylog but there were no logs after all. Eventually he removed solarwinds and installed nxlog. Messages are now being received and available. We solved our problem, but there might be an issue that relates to solarwinds log forwarder and Graylog.

9

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.