Questions tagged [graylog]
Graylog is a full-featured open source log management solution.
92
questions
0
votes
1
answer
172
views
Docker-compose rsync backup
I recently started working with docker-compose, and I'm currently in a situation where I need to upgrade the VM server. Unfortunately, I don't have access to the snapshot/restore option for certain ...
0
votes
0
answers
83
views
Containerd GELF logging driver does not send logs to graylog
Can anyone give me some hints how can i send logs from containerd 1.6.19 to graylog using the GELF logging driver ?
I have set in my /etc/containerd/config.toml :
[plugins."io.containerd.grpc.v1....
2
votes
2
answers
135
views
How do we prevent accidental Graylog denial of service problems without multiple graylog instances?
Our original problem
Last year we had a problem where a rogue piece of software on one server spammed our central Graylog Server with so many messages that it caused problems for other applications.
...
1
vote
0
answers
53
views
Kafka not stopping consumers when deleting group
I am sending logs from Logstash as the producer to Kafka and then consuming them from Graylog. This works as expected.
However, when stopping the Graylog input, thus sending a LeaveGroup request, the ...
0
votes
1
answer
217
views
Stop filebeat sending copius metadata
I am sending data from local log files with filebeat to graylog and I am getting a 20x storage overhead compared to the original files. There are a large amount of metadata fields however I can't seem ...
1
vote
0
answers
60
views
Certificate only works from client side, how do I debug something like this? (graylog/filebeat/JVM keystore)
I created 2 key-certificate pairs with the exact same method. However, while trying to setup TLS on my graylog server to a remote filebeat node, it does not successfully connect when trying to connect ...
0
votes
1
answer
96
views
Multiple logging managers for different services, or one with multiple databases (graylog)
I am creating a logging infrastructure for a company with 2 unrelated services. Is it better to have:
a single graylog instance that routes the logs from the two services
to different elasticsearch ...
1
vote
1
answer
100
views
Handle 150 req/s and 2TB of logs for 7 days of retention available by API
I would like to get advise from experienced people to build a HA infrastructure to log 2To of data in JSON format every week.
I need to have a retention time of 7 days and need to be able to requests ...
0
votes
1
answer
471
views
Graylog - data from newest indice not returned on search
I have a Graylog server (newest version) collecting data from nginx. It´s been running for a while. I retrieve the collected data by querying my Elasticsearch cluster (v7 newest version) which ...
0
votes
1
answer
294
views
does remote logging stops local logging
I'm using a Graylog server to centralize logs from network equipment and servers and I'm wondering if the Syslog service on the switches, windows machines, and other equipment, that service still ...
1
vote
0
answers
465
views
Installing Graylog with Nxlog collector on a Windows DC: no service installed
I'm trying to install a NxLog collector on a Graylog client machine. The Graylog and associated infra (elastic and mongodb) is running just fine.
The install client is a Windows Server 2019 DC ("...
0
votes
1
answer
610
views
Graylog Email Alert Password Not Working?
I recently changed my gmail password and changed the password in server.conf as well, but now graylog's email alerting fails with:
Sending the email to the following server failed : smtp.gmail.com:587 ...
1
vote
1
answer
398
views
graylog 4.0 - Injector could not be created
Trying to set up graylog with official graylog2.graylog ansible role.
Installed Elasticsearch (v7.10.2) cluster on three separate servers with official elasticsearch ansible role (node_1 - master, ...
0
votes
1
answer
547
views
Graylog fails to parse nginx access_log: JsonParseException: Unexpected character ('<' (code 60))
I've followed https://github.com/ronlut/graylog-content-pack-nginx-docker and Send NGINX logs to Graylog to try to get nginx logs into a graylog 4.1.5 server. Graylog is not displaying messages ...
0
votes
1
answer
1k
views
Graylog does not receive logs from Docker Swarm Services
I'm new with Graylog and I'm trying to use Graylog on a Docker Container, but the logs from the others containers does not arrive on Graylog and nothing is displayed on the Graylog web interface ...
2
votes
1
answer
2k
views
When to use a new index in Graylog (Elasticsearch)?
I have been searching for days now to find a good explanation on how indices are used by Graylog/Elasticsearch and when to create a new one. There is a lot of info about sharding indices but not much ...
-1
votes
1
answer
669
views
How to install graylog application on GCP Kubernetes Cluster
I am trying to install
CAdvisor
Graylog
on Kubernetes Cluster. For now I just need to install simple application.
But when installing graylog using Its documentation. I am getting this error
"...
1
vote
0
answers
562
views
GELF json logs stop arriving on graylog after some time from nginx proxy in docker
Hmm..where to start...i've got an application stack (running in docker swarm), with nginx as proxy in front. Ive got json-formatted logs, being sent to graylog via gelf.
Container system is alpine 3....
1
vote
0
answers
111
views
Graylog correlation rules original messages
I’m using Graylog V3.1.2 with an enterprise plugin.
I created a correlation rule that triggers alert whenever two events occur.
When I’m looking at the “All events” stream and find the correlation ...
1
vote
0
answers
949
views
syslog udp load balancing and failover with keepalived
I have a simple two host graylog cluster for which i need to load balance udp syslog traffic, I'm using keepalived, floating ip and load balancing work perfectly, but it still directs traffic to all ...
0
votes
1
answer
1k
views
Grok filter for Cisco ASA
How can i get port from cisco ASA syslog using grok pattern.
I have tried some methods and its not working . We are using graylog for collecting log data.
Eg Log :
%ASA-6-301014: Teardown TCP ...
-1
votes
2
answers
240
views
graylog does not work out of the box
http://docs.graylog.org/en/3.0/pages/installation/docker.html
$ docker run --name mongo -d mongo:3
$ docker run --name elasticsearch \
-e "http.host=0.0.0.0" \
-e "ES_JAVA_OPTS=-Xms512m -...
0
votes
1
answer
642
views
GrayLog, can not see any logs
I install it as:
$ docker run --name mongo -d mongo:3
$ docker run --name elasticsearch -p 9200:9200 -p 9300:9300 \
-e ES_JAVA_OPTS="-Xms2g -Xmx4g" \
-e "discovery.type=single-node" -e "xpack....
1
vote
2
answers
3k
views
nginx: exclude sub-location in reverse proxy configuration
I want to build a http to https reverse proxy based on nginx for a graylog instance, let's say it's url is graylog.domain.local.
Graylog does NOT serve ssl encrypted connections, just standard http ...
0
votes
1
answer
634
views
Mapping fields from a beats log message in graylog
this is a slightly rephrased version of:
Whos is eating my fields? (or: how do I get more of the custom fields from my beats message into graylog)
i am using filebeat to collect logs from a bunch ...
0
votes
1
answer
217
views
NXLog TLS configuration
I am trying to send logs using nxlog installed on a windows server to graylog server using TLS. I have created a self signed certificate.
My questions is, if I set AllowUntrusted value to True in ...
1
vote
1
answer
154
views
Analysing AWS Cloud Trail logs to get security insights
I have enabled the cloud trail logs and I get the logs to my graylog system. Now how can I do analysis on the following use cases:
What if same user is trying to login and using from different Source ...
2
votes
0
answers
2k
views
Keepalived forwarding UDP traffic to one node via NAT
I am having issues with load balancing UDP Syslog to my Graylog cluster nodes. At first everything seemed to work normal but it seems that traffic is flowing for 99% to one of the two nodes.
I have ...
-1
votes
1
answer
240
views
Graylog CSV Export is slow after upgrade
After I upgraded from graylog version 2.2.1 to 2.4.3, the csv export became quite slow compared to the previous download rate. I have to say that I did many changes
putting it behind pfsense
using ...
0
votes
1
answer
2k
views
run graylog in different port
Hi I used openstack qcow2 format and run the graylog server
Now I can access my openstack machine only using floating public IP address and not via private Internal IP address.
Here when I do ...
2
votes
1
answer
370
views
Server currently unavailable for Ubuntu 16.04
Background
I have an Ubuntu 16.04 clean VM, and I am trying to install the latest version of graylog on it. Unfortunately, it is failing.
What did I do?
First I created a clean VM with the afore ...
1
vote
1
answer
837
views
Graylog: Is it possible to view a chunk of logs all at once?
Sometimes I would like to view log entries as a "standard" looking text based log file.
Right now sometimes I'll end up going to the server where the logs were generated just so I can display a ...
0
votes
1
answer
413
views
Any way to save Suricata alert payload?
I've followed some directions for setting up Graylog and Snort (I used Suricata however) here but it would be nice to be able to see what the Alert payload was which generated the event.
An ...
7
votes
1
answer
17k
views
Send NGINX logs to Graylog
I'm trying to collect nginx error and access logs with graylog, I think everything is correctly configured, but Graylog receive nothing from NGINX
(Graylog & NGINX are in docker containers and ...
0
votes
1
answer
791
views
rsyslog upload limitation?
I use rsyslog to upload logs to my Graylog server
/etc/rsyslog.conf:
$InputFileName /var/log/apache-error.log
$InputFileFacility apache
$InputFileTag #apacheError:
$InputFileStateFile apache-error
$...
0
votes
1
answer
1k
views
Graylog Alert is automatically resolving itself.
Graylog v2.3.2
My goal is to have a condition raise an alert, and the alert remain open until it's marked resolved or a defined resolved condition applies.
I have an alert setup and here is the ...
3
votes
0
answers
1k
views
Log custom header X-API-KEY from nginx to Graylog
I have an nginx (1.12.1) server running on VPS#1 and I have Graylog running on VPS#2. All sys + nginx logs are sent to Graylog.
To get nginx working I've had to install the nginx content pack from ...
1
vote
0
answers
481
views
How do you deploy Graylog to an AWS Linux server?
I followed these directions (graylog's website) to deploy Graylog to an Ubuntu server in AWS. I created a server with 4 GB of RAM.
I created a security group that allows inbound connections on any ...
0
votes
1
answer
576
views
Graylog v1.1.1: Editing source IP Address to reflect the IP inside a time stamp
I wonder if you can help with the following query?
I have a client (Centos 7) server (IP 1.1.1.1) in my office that sends its logs to a Centos 7 Syslog server (IP address 1.1.1.2). The syslog server ...
0
votes
1
answer
841
views
Applying item template to elasticsearch
I am trying to apply an item template to my elasticsearch cluster, to deal with the issue of having fields with content longer than 32kb.
I am using version 2.4.4, as this is the highest supported ...
0
votes
1
answer
114
views
Can Graylog set up an alert that triggers on a # of messages PER HOSTNAME?
I have a multi-tenant app, and I'd like to be able to have Graylog alert on things per tenant (essentially per hostname).
So for example, rather than just doing this (which would aggregate data ...
0
votes
1
answer
177
views
Does Graylog2 monitor services and hard disks like Icinga2?
We have graylog2 set up to monitor the syslogs, etc.
However we're wondering if we can use it to monitor the different services, if they're down or not, if the hard disk is filling up.
Does it ...
0
votes
1
answer
3k
views
Graylog stream getting events, but is empty
I've started sending Palo Alto logs to Graylog, and a stream rule picks them out by matching "Palo Alto" in a "tags" field (which is how all my stream rules are; a front-end Logstash instance does the ...
0
votes
2
answers
2k
views
Is it safe to delete Gralog Indexes
ElastiCache Cluster was in red state. Below is the out of cluster health Status
{
"cluster_name" : "graylog",
"status" : "red",
"timed_out" : false,
"number_of_nodes" : 1,
"number_of_data_nodes" : 1,
...
0
votes
1
answer
2k
views
502 Bad Gatway graylog
I am using nginx as a reverse proxy.graylog uri conf
graylog.conf:
rest_listen_uri= http://127.0.0.1:9000/
rest_transport_uri = http://192.168.1.1:9000/api/
nginx.conf:
server {
server_name ...
2
votes
2
answers
5k
views
Graylog: Fields from Pipeline rule not showing up in search data
I'm trying out Graylog for system logs and Snort alerts. I've followed the example here to get my snort alerts into Graylog and then proceeded to add another Stream, Pipeline and Rule for a separate ...
3
votes
1
answer
142
views
restrict which server can send logs to graylog
I can send logs to graylog server by providing specific details in my rsyslog file on the node.Something like this
*.* @logs.example.com:1337
My question is that if someone else also has this info ...
0
votes
1
answer
4k
views
elasticsearch: limiting disk space
I'm using elasticsearch in conjunction with Graylog.
Is there a way to limit the size of the elasticsearch database, possibly using a round-robin database approach for the logs? My setup is ...
1
vote
1
answer
1k
views
Can I use AWS ES be integrated with Graylog2?
I am on a very initial setup and I want to know if I can use ES offered by AWS as a service to the Graylog2?
I am quite sure this cannot be accomplished since AWS doesn't offer anything to ...
1
vote
1
answer
143
views
Graylog2 - Grouping on host name variants
We are sending Apache access logs to Graylog (2.1.1). We have 70+ websites and I want to build a quick value chart for say all requests that resulted in a 5xx response.
Currently when I create said ...