# Wrong gl2\_remote\_ip

**URL:** <https://community.graylog.org/t/wrong-gl2-remote-ip/2492>\
**Category:** Graylog Central (peer support)\
**Tags:** sidecar, nxlog, nodatanx\
**Created:** [September 18, 2017, 1:14pm UTC](https://community.graylog.org/t/wrong-gl2-remote-ip/2492 "2017-09-18T13:14:27Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![cmiscloni](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/cmiscloni/32/901_2.png) [@cmiscloni](https://community.graylog.org/u/cmiscloni)\
**Post date:** [September 18, 2017, 1:14pm UTC](https://community.graylog.org/t/wrong-gl2-remote-ip/2492/1 "2017-09-18T13:14:27Z")

</div>

Hi all,

I’ve got sometimes some wrong gl2\_remote\_ip in my logs.  
Is there any DNS caching in place to retrieve the information ?  
If yes, how I can fix this ?

Thanks

---

<div class="post-metadata">

**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\
**Post date:** [September 18, 2017, 1:40pm UTC](https://community.graylog.org/t/wrong-gl2-remote-ip/2492/2 "2017-09-18T13:40:22Z")

</div>

> [@cmiscloni](#):
>
> I’ve got sometimes some wrong gl2\_remote\_ip in my logs.

What does “wrong” mean exactly?

How are you sending logs to Graylog?  
What’s the configuration of the clients sending messages to Graylog?  
What’s the configuration of the Graylog input(s)?  
What do you expect the `gl2_remote_ip` field to contain and what’s the actual content?

---

<div class="post-metadata">

**Author:** ![cmiscloni](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/cmiscloni/32/901_2.png) [@cmiscloni](https://community.graylog.org/u/cmiscloni)\
**Post date:** [September 18, 2017, 2:26pm UTC](https://community.graylog.org/t/wrong-gl2-remote-ip/2492/3 "2017-09-18T14:26:29Z")

</div>

I use nxlog to send the logs.  
Graylog input is 🙂 ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/1X/f34834feb0a3dc0aef50e3856512bc72991c5981.png)

This happen on few clients, Windows 10 Pro 1607

Nxlog conf:

```
define ROOT C:\Program Files (x86)\nxlog

Moduledir %ROOT%\modules
CacheDir %ROOT%\data
Pidfile %ROOT%\data\nxlog.pid
SpoolDir %ROOT%\data
LogFile %ROOT%\data\nxlog.log

<Extension gelf>
    Module xm_gelf
</Extension>

<Input in>
    Module im_msvistalog
	ReadFromLast TRUE
	SavePos TRUE
	Query <QueryList>\
				<Query Id="0">\
					<Select Path="Microsoft-Windows-WLAN-AutoConfig/Operational">*[System[Provider[@Name="Microsoft-Windows-WLAN-AutoConfig"] and (EventID=11001)]]</Select>\
	</Query>\
	</QueryList>
		
</Input>

<Output out>
    Module om_udp
    Host graylog.XXXXXXX
    Port 12201
	OutputType GELF
</Output>

<Route 1>
    Path in => out
</Route>

```

The IP is an internal IP instead to be a VPN IP. Like if the function used a cached information.  
Sometimes it’s true but sometimes not.

---

<div class="post-metadata">

**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\
**Post date:** [September 18, 2017, 3:08pm UTC](https://community.graylog.org/t/wrong-gl2-remote-ip/2492/4 "2017-09-18T15:08:26Z")

</div>

> [@cmiscloni](#):
>
> The IP is an internal IP instead to be a VPN IP.

The `gl2_remote_ip` field contains the IP address of the message sender connected to the network socket as provided by the operating system. Graylog doesn’t cache this information. The operating system _might_ cache it, but it’s rather unlikely.

Are you sending messages from NXLOG to Graylog through a VPN?  
What’s the configuration of that VPN?

Relevant code snippets:

> <https://github.com/Graylog2/graylog2-server/blob/2.3.1/graylog2-server/src/main/java/org/graylog2/plugin/inputs/transports/NettyTransport.java#L344>

> <https://github.com/Graylog2/graylog2-server/blob/2.3.1/graylog2-server/src/main/java/org/graylog2/shared/buffers/processors/DecodingProcessor.java#L226-L227>

---

<div class="post-metadata">

**Author:** ![cmiscloni](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/cmiscloni/32/901_2.png) [@cmiscloni](https://community.graylog.org/u/cmiscloni)\
**Post date:** [September 18, 2017, 3:15pm UTC](https://community.graylog.org/t/wrong-gl2-remote-ip/2492/5 "2017-09-18T15:15:06Z")

</div>

Yes through OpenVPN.

```
ip-win32 dynamic
client
dev tun
proto tcp
remote xxxxxx 443
tls-remote "xxxx"
route remote_host 255.255.255.255 net_gateway
resolv-retry infinite
nobind
persist-key
persist-tun
ca xxxxx.com.ca.crt
cert xxxx.com.user.crt
key xxxxx.com.user.key
auth-user-pass
cipher AES-128-CBC
auth SHA1
comp-lzo 
route-delay 4
verb 3
reneg-sec 0
```

---

<div class="post-metadata">

**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\
**Post date:** [September 18, 2017, 3:47pm UTC](https://community.graylog.org/t/wrong-gl2-remote-ip/2492/6 "2017-09-18T15:47:14Z")

</div>

And which address would you expect the `gl2_remote_ip` field to contain?  
Remember that the whole purpose of using a VPN is being able to access “internal” hosts in a secure way.

---

<div class="post-metadata">

**Author:** ![cmiscloni](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/cmiscloni/32/901_2.png) [@cmiscloni](https://community.graylog.org/u/cmiscloni)\
**Post date:** [September 18, 2017, 5:05pm UTC](https://community.graylog.org/t/wrong-gl2-remote-ip/2492/7 "2017-09-18T17:05:52Z")

</div>

The IP of the VPN Pool.  
Most of clients have the good one with the same configuration and the clients which have wrong IP have Internal IP gave by our Internal DNS so it’s impossible to have it on VPN link.  
It’s for this I spoke about possible DNS caches.

---

<div class="post-metadata">

**Author:** ![cmiscloni](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/cmiscloni/32/901_2.png) [@cmiscloni](https://community.graylog.org/u/cmiscloni)\
**Post date:** [September 18, 2017, 6:50pm UTC](https://community.graylog.org/t/wrong-gl2-remote-ip/2492/8 "2017-09-18T18:50:44Z")

</div>

It’s seems that computer which doesn’t restart after an internal connection keep internal IP.  
The OpenVPN client doesn’t update IP but VPN connection works.  
Any ideas or how can I do to retrieve the real IP ?

Thanks

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [October 2, 2017, 6:51pm UTC](https://community.graylog.org/t/wrong-gl2-remote-ip/2492/9 "2017-10-02T18:51:01Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.