Questions tagged [graylog]
Graylog is a full-featured open source log management solution.
87
questions
1
vote
0
answers
44
views
Certificate only works from client side, how do I debug something like this? (graylog/filebeat/JVM keystore)
I created 2 key-certificate pairs with the exact same method. However, while trying to setup TLS on my graylog server to a remote filebeat node, it does not successfully connect when trying to connect ...
- 23
0
votes
1
answer
45
views
Multiple logging managers for different services, or one with multiple databases (graylog)
I am creating a logging infrastructure for a company with 2 unrelated services. Is it better to have:
a single graylog instance that routes the logs from the two services
to different elasticsearch ...
- 23
0
votes
1
answer
64
views
Handle 150 req/s and 2TB of logs for 7 days of retention available by API
I would like to get advise from experienced people to build a HA infrastructure to log 2To of data in JSON format every week.
I need to have a retention time of 7 days and need to be able to requests ...
0
votes
1
answer
382
views
Graylog - data from newest indice not returned on search
I have a Graylog server (newest version) collecting data from nginx. It´s been running for a while. I retrieve the collected data by querying my Elasticsearch cluster (v7 newest version) which ...
- 71
0
votes
1
answer
174
views
does remote logging stops local logging
I'm using a Graylog server to centralize logs from network equipment and servers and I'm wondering if the Syslog service on the switches, windows machines, and other equipment, that service still ...
- 5
1
vote
0
answers
345
views
Installing Graylog with Nxlog collector on a Windows DC: no service installed
I'm trying to install a NxLog collector on a Graylog client machine. The Graylog and associated infra (elastic and mongodb) is running just fine.
The install client is a Windows Server 2019 DC ("...
0
votes
1
answer
514
views
Graylog Email Alert Password Not Working?
I recently changed my gmail password and changed the password in server.conf as well, but now graylog's email alerting fails with:
Sending the email to the following server failed : smtp.gmail.com:587 ...
- 87
0
votes
1
answer
303
views
graylog 4.0 - Injector could not be created
Trying to set up graylog with official graylog2.graylog ansible role.
Installed Elasticsearch (v7.10.2) cluster on three separate servers with official elasticsearch ansible role (node_1 - master, ...
- 113
0
votes
1
answer
419
views
Graylog fails to parse nginx access_log: JsonParseException: Unexpected character ('<' (code 60))
I've followed https://github.com/ronlut/graylog-content-pack-nginx-docker and Send NGINX logs to Graylog to try to get nginx logs into a graylog 4.1.5 server. Graylog is not displaying messages ...
- 1
0
votes
1
answer
883
views
Graylog does not receive logs from Docker Swarm Services
I'm new with Graylog and I'm trying to use Graylog on a Docker Container, but the logs from the others containers does not arrive on Graylog and nothing is displayed on the Graylog web interface ...
- 101
2
votes
1
answer
2k
views
When to use a new index in Graylog (Elasticsearch)?
I have been searching for days now to find a good explanation on how indices are used by Graylog/Elasticsearch and when to create a new one. There is a lot of info about sharding indices but not much ...
- 133
-1
votes
1
answer
518
views
How to install graylog application on GCP Kubernetes Cluster
I am trying to install
CAdvisor
Graylog
on Kubernetes Cluster. For now I just need to install simple application.
But when installing graylog using Its documentation. I am getting this error
"...
google-cloud-platform
1
vote
0
answers
490
views
GELF json logs stop arriving on graylog after some time from nginx proxy in docker
Hmm..where to start...i've got an application stack (running in docker swarm), with nginx as proxy in front. Ive got json-formatted logs, being sent to graylog via gelf.
Container system is alpine 3....
- 11
1
vote
0
answers
104
views
Graylog correlation rules original messages
I’m using Graylog V3.1.2 with an enterprise plugin.
I created a correlation rule that triggers alert whenever two events occur.
When I’m looking at the “All events” stream and find the correlation ...
- 111
1
vote
0
answers
835
views
syslog udp load balancing and failover with keepalived
I have a simple two host graylog cluster for which i need to load balance udp syslog traffic, I'm using keepalived, floating ip and load balancing work perfectly, but it still directs traffic to all ...
- 11
0
votes
1
answer
981
views
Grok filter for Cisco ASA
How can i get port from cisco ASA syslog using grok pattern.
I have tried some methods and its not working . We are using graylog for collecting log data.
Eg Log :
%ASA-6-301014: Teardown TCP ...
- 81
-1
votes
2
answers
174
views
graylog does not work out of the box
http://docs.graylog.org/en/3.0/pages/installation/docker.html
$ docker run --name mongo -d mongo:3
$ docker run --name elasticsearch \
-e "http.host=0.0.0.0" \
-e "ES_JAVA_OPTS=-Xms512m -...
- 99
0
votes
1
answer
549
views
GrayLog, can not see any logs
I install it as:
$ docker run --name mongo -d mongo:3
$ docker run --name elasticsearch -p 9200:9200 -p 9300:9300 \
-e ES_JAVA_OPTS="-Xms2g -Xmx4g" \
-e "discovery.type=single-node" -e "xpack....
- 99
1
vote
2
answers
3k
views
nginx: exclude sub-location in reverse proxy configuration
I want to build a http to https reverse proxy based on nginx for a graylog instance, let's say it's url is graylog.domain.local.
Graylog does NOT serve ssl encrypted connections, just standard http ...
- 142
0
votes
1
answer
597
views
Mapping fields from a beats log message in graylog
this is a slightly rephrased version of:
Whos is eating my fields? (or: how do I get more of the custom fields from my beats message into graylog)
i am using filebeat to collect logs from a bunch ...
- 176
0
votes
1
answer
197
views
NXLog TLS configuration
I am trying to send logs using nxlog installed on a windows server to graylog server using TLS. I have created a self signed certificate.
My questions is, if I set AllowUntrusted value to True in ...
1
vote
1
answer
143
views
Analysing AWS Cloud Trail logs to get security insights
I have enabled the cloud trail logs and I get the logs to my graylog system. Now how can I do analysis on the following use cases:
What if same user is trying to login and using from different Source ...
2
votes
0
answers
2k
views
Keepalived forwarding UDP traffic to one node via NAT
I am having issues with load balancing UDP Syslog to my Graylog cluster nodes. At first everything seemed to work normal but it seems that traffic is flowing for 99% to one of the two nodes.
I have ...
- 121
-1
votes
1
answer
219
views
Graylog CSV Export is slow after upgrade
After I upgraded from graylog version 2.2.1 to 2.4.3, the csv export became quite slow compared to the previous download rate. I have to say that I did many changes
putting it behind pfsense
using ...
- 166
0
votes
1
answer
1k
views
run graylog in different port
Hi I used openstack qcow2 format and run the graylog server
Now I can access my openstack machine only using floating public IP address and not via private Internal IP address.
Here when I do ...
2
votes
1
answer
357
views
Server currently unavailable for Ubuntu 16.04
Background
I have an Ubuntu 16.04 clean VM, and I am trying to install the latest version of graylog on it. Unfortunately, it is failing.
What did I do?
First I created a clean VM with the afore ...
- 131
1
vote
1
answer
673
views
Graylog: Is it possible to view a chunk of logs all at once?
Sometimes I would like to view log entries as a "standard" looking text based log file.
Right now sometimes I'll end up going to the server where the logs were generated just so I can display a ...
- 2,127
0
votes
1
answer
374
views
Any way to save Suricata alert payload?
I've followed some directions for setting up Graylog and Snort (I used Suricata however) here but it would be nice to be able to see what the Alert payload was which generated the event.
An ...
- 3,624
7
votes
1
answer
16k
views
Send NGINX logs to Graylog
I'm trying to collect nginx error and access logs with graylog, I think everything is correctly configured, but Graylog receive nothing from NGINX
(Graylog & NGINX are in docker containers and ...
- 96
0
votes
1
answer
731
views
rsyslog upload limitation?
I use rsyslog to upload logs to my Graylog server
/etc/rsyslog.conf:
$InputFileName /var/log/apache-error.log
$InputFileFacility apache
$InputFileTag #apacheError:
$InputFileStateFile apache-error
$...
- 103
0
votes
1
answer
1k
views
Graylog Alert is automatically resolving itself.
Graylog v2.3.2
My goal is to have a condition raise an alert, and the alert remain open until it's marked resolved or a defined resolved condition applies.
I have an alert setup and here is the ...
- 2,127
3
votes
0
answers
1k
views
Log custom header X-API-KEY from nginx to Graylog
I have an nginx (1.12.1) server running on VPS#1 and I have Graylog running on VPS#2. All sys + nginx logs are sent to Graylog.
To get nginx working I've had to install the nginx content pack from ...
- 175
1
vote
0
answers
437
views
How do you deploy Graylog to an AWS Linux server?
I followed these directions (graylog's website) to deploy Graylog to an Ubuntu server in AWS. I created a server with 4 GB of RAM.
I created a security group that allows inbound connections on any ...
- 11
0
votes
1
answer
544
views
Graylog v1.1.1: Editing source IP Address to reflect the IP inside a time stamp
I wonder if you can help with the following query?
I have a client (Centos 7) server (IP 1.1.1.1) in my office that sends its logs to a Centos 7 Syslog server (IP address 1.1.1.2). The syslog server ...
0
votes
1
answer
819
views
Applying item template to elasticsearch
I am trying to apply an item template to my elasticsearch cluster, to deal with the issue of having fields with content longer than 32kb.
I am using version 2.4.4, as this is the highest supported ...
0
votes
1
answer
105
views
Can Graylog set up an alert that triggers on a # of messages PER HOSTNAME?
I have a multi-tenant app, and I'd like to be able to have Graylog alert on things per tenant (essentially per hostname).
So for example, rather than just doing this (which would aggregate data ...
- 1,151
0
votes
1
answer
171
views
Does Graylog2 monitor services and hard disks like Icinga2?
We have graylog2 set up to monitor the syslogs, etc.
However we're wondering if we can use it to monitor the different services, if they're down or not, if the hard disk is filling up.
Does it ...
- 133
0
votes
1
answer
2k
views
Graylog stream getting events, but is empty
I've started sending Palo Alto logs to Graylog, and a stream rule picks them out by matching "Palo Alto" in a "tags" field (which is how all my stream rules are; a front-end Logstash instance does the ...
- 420
0
votes
2
answers
2k
views
Is it safe to delete Gralog Indexes
ElastiCache Cluster was in red state. Below is the out of cluster health Status
{
"cluster_name" : "graylog",
"status" : "red",
"timed_out" : false,
"number_of_nodes" : 1,
"number_of_data_nodes" : 1,
...
- 101
0
votes
1
answer
2k
views
502 Bad Gatway graylog
I am using nginx as a reverse proxy.graylog uri conf
graylog.conf:
rest_listen_uri= http://127.0.0.1:9000/
rest_transport_uri = http://192.168.1.1:9000/api/
nginx.conf:
server {
server_name ...
- 101
2
votes
2
answers
5k
views
Graylog: Fields from Pipeline rule not showing up in search data
I'm trying out Graylog for system logs and Snort alerts. I've followed the example here to get my snort alerts into Graylog and then proceeded to add another Stream, Pipeline and Rule for a separate ...
- 3,624
3
votes
1
answer
119
views
restrict which server can send logs to graylog
I can send logs to graylog server by providing specific details in my rsyslog file on the node.Something like this
*.* @logs.example.com:1337
My question is that if someone else also has this info ...
- 171
0
votes
1
answer
4k
views
elasticsearch: limiting disk space
I'm using elasticsearch in conjunction with Graylog.
Is there a way to limit the size of the elasticsearch database, possibly using a round-robin database approach for the logs? My setup is ...
- 151
1
vote
1
answer
1k
views
Can I use AWS ES be integrated with Graylog2?
I am on a very initial setup and I want to know if I can use ES offered by AWS as a service to the Graylog2?
I am quite sure this cannot be accomplished since AWS doesn't offer anything to ...
- 113
1
vote
1
answer
118
views
Graylog2 - Grouping on host name variants
We are sending Apache access logs to Graylog (2.1.1). We have 70+ websites and I want to build a quick value chart for say all requests that resulted in a 5xx response.
Currently when I create said ...
- 941
3
votes
2
answers
3k
views
Different extractors for the same Graylog input?
I'm using Graylog's sidecar functionality with Filebeat to pickup a number of different log files off my server, including Syslog, Nginx and Java App. All of these flow into the same Graylog input for ...
- 632
2
votes
3
answers
3k
views
Forwarding logs from rsyslog to graylog over tls
I'm trying to forward logs from rsyslog to graylog over tls.
rsyslog configuration:
# make gtls driver the default
$DefaultNetstreamDriver gtls
#
# # certificate files
$DefaultNetstreamDriverCAFile /...
- 123
1
vote
1
answer
3k
views
Loading field information in Graylog 2.1.x failed with status 500 (Internal Server Error)
I'm working on setting up a Graylog and I'm getting the following error:
Loading field information failed with status: cannot GET http://192.168.2.108:12900/system/fields (500)
I am on this page:
...
- 3,881
-1
votes
1
answer
9k
views
How to bind use port 514 so graylog can use as input source
How can I bind 514 so it can be used by graylog.
There are examples like
iptables -t nat -A PREROUTING -i eth0 -p udp -m udp --dport 514 -j REDIRECT --to-ports 5514
But what I want is to use 514 ...
- 202
0
votes
1
answer
386
views
Graylog alert on unique email addresses?
We are trying to figure out if there is a way to create a stream/alert that will detect when an email address has been in a log more than X times. From what we can tell I can only count the total ...
- 351