[graylog2] Troubleshooting logs

[Tom Powers]

Hello,

If I'm trying to troubleshoot why an output from a stream , being forwarded
to another graylog server, and the stream populates but the receiving
server shows nothing, which logs on the graylog boxes would I check to see
if I have an output or an input problem?

Thanks

TP

[Jochen Schalanda]

Hi Tom,

please share all relevant details about your setup (configuration of the
output, configuration of the receiving server, logs of both systems, etc.).

See http://docs.graylog.org/en/2.2/pages/configuration/file_location.html
for the correct file locations in your system.

Cheers,
Jochen

Post by Tom Powers
Hello,
If I'm trying to troubleshoot why an output from a stream , being
forwarded to another graylog server, and the stream populates but the
receiving server shows nothing, which logs on the graylog boxes would I
check to see if I have an output or an input problem?
Thanks
TP

[Tom Powers]

OK...so here's the scoop. All Graylog Servers in use are built from the
OVA...all version 2.13

Graylog Server 1 - Sits at our remote office. Collects Windows Events for
the site. It has a series of streams setup. Each stream is using a GELF TCP
port 12203 output to my main office
Graylog Server 2 - Sits at main office. It has a Gelf TCP input for 12203
to receive streams from remote office.

Trying to send the stream through the internet over TLS. My firewall at
main office has 12203 open and pointing to graylog server 2

Issue:

If I leave TLS off, then the system works great.

If I turn TLS on for the Input side (Server 2), and click the Verify TLS on
the client side(server1) (like I have done in my test lab), then the
Server2 doesn't receive anything on the input.

I see traffic in the firewall over 12203

Logs on servers are showing no errors (though admittedly...I may not be
looking in the right area)

I assume I have not setup TLS correctly and the docs are a bit vague on that

Any insight is appreciated

Thanks

TP

Post by Tom Powers
Hello,
If I'm trying to troubleshoot why an output from a stream , being
forwarded to another graylog server, and the stream populates but the
receiving server shows nothing, which logs on the graylog boxes would I
check to see if I have an output or an input problem?
Thanks
TP

[Jochen Schalanda]

Hi Tom,

Post by Tom Powers
If I turn TLS on for the Input side (Server 2), and click the Verify TLS
on the client side(server1) (like I have done in my test lab), then the
Server2 doesn't receive anything on the input.

Have the SSL certificates you're using been signed by a public CA or did
you add them to the JVM trust store on the second server? If not, that's
the problem.

Cheers,
Jochen

[Tom Powers]

That's the problem then.

What files need to move from the server 2 took the server 1 machines?

Getting to find doc on that, but it's sparse

Thanks

Tp

[Tom Powers]

I've found this article on the right place to put the certs...but not sure what format or how to get them out of the master server

http://docs.graylog.org/en/2.0/pages/faq.html#i-have-configured-an-smtp-server-or-an-output-with-tls-connection-and-receive-handshake-errors-what-should-i-do

[Jochen Schalanda]

Hi Tom,

Post by Tom Powers
I've found this article on the right place to put the certs...but not sure
what format or how to get them out of the master server
http://docs.graylog.org/en/2.0/pages/faq.html#i-have-configured-an-smtp-server-or-an-output-with-tls-connection-and-receive-handshake-errors-what-should-i-do

See
http://docs.graylog.org/en/2.2/pages/configuration/https.html#adding-a-self-signed-certificate-to-the-jvm-trust-store
for instructions for how to add certificates to the JVM trust store.

Cheers,
Jochen