I'm testing Graylog2 as our central log management tool for our applications. Is there a way to secure the log submit process?

If we only use graylog2 in our local environment its not a big deal to secure the submit process through some firewall rules, e.g. only accept network traffic from internal ip subnets, but is there a way for public clients to authenticate against graylog2 and submit only if for example a login-token is submitted through the log.

In short: Is there a way to protect a graylog2 server against spam logs?

If you use GELF/TCP as transport mechanism then you can secure and authenticate it with TLS, e.g. using stunnel.

If you do not use GELF but plain Syslog then many implementations (rsyslog, syslog-ng) have some TLS support for legacy BSD Syslog, as well as Syslog/TLS according to RFC5425.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.