I am using Graylog single node and on version 2.3.0.
I need some help in checking / troubleshooting why my Graylog server is not receiving rsyslog logs from some linux servers. I have done the necessary rsyslog configuration on my linux hosts, however in my Graylog WEB UI i neither see any logs coming in from these servers nor do these servers show up in the list under “Sources” page.
I then tried using tcp dump command on my graylog server to check if its receiving data or not. What’s weird is that tcpdump output is not showing any incoming traffic from any of my sources (even stuff that’s working) . I am successfully receiving logs from cpl of windows hosts & cisco switches. Why is tcpdump not even showing that under here ?
Output of tcpdump:
icssec@gitlab:~$ sudo tcpdump -i any -v 'port 514' tcpdump: listening on any, link-type LINUX_SLL (Linux cooked), capture size 262144 bytes